diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e27db24..ffbdc27 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,10 +10,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '17' distribution: 'temurin' @@ -23,7 +23,7 @@ jobs: run: mvn clean package - name: Upload jar artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: runtime-analyst-jar path: target/runtime-analyst-*.jar diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2c80f5f..f6ed359 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,10 +12,10 @@ jobs: build-and-release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 - name: Set up JDK 17 - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: java-version: '17' distribution: 'temurin' diff --git a/.gitignore b/.gitignore index a972429..233a436 100644 --- a/.gitignore +++ b/.gitignore @@ -21,6 +21,7 @@ CLAUDE.md cbom*.json aibom*.json blueprint*.json +vex*.json # Shell scripts (may contain credentials) *.sh diff --git a/README.md b/README.md index 94122e1..513f188 100644 --- a/README.md +++ b/README.md @@ -1,24 +1,19 @@ # Runtime Analyst -Runtime Analyst turns Contrast Security's runtime observability data into structured, standard reports, across three domains: +Runtime Analyst turns Contrast Security's runtime observability data into structured, standard reports. RA doesn't scan source code or dependency manifests - it reads what Contrast's agents observed actually running in your applications, with full stack traces, usage counts, and architecture context. This runtime visibility is critical for post-quantum migration and AI governance planning - you need to know not just *what's* in use, but *how* it's being used and by *what*. -- **Crypto** - every cryptographic algorithm observed running in your applications, with NIST post-quantum vulnerability classification -- **AI** - every AI model and provider observed running, with cloud-vs-local classification for shadow-AI visibility -- **Blueprint (alpha)** - a map of how your applications connect and behave: assets, deployment zones, connections, and crypto/AI behaviors - -For Crypto and AI, it produces both a [CycloneDX](https://cyclonedx.org/) Bill of Materials - **CBOM** and **AI-BOM** - and an AI-powered analysis report - **Quantum Advisor** and **AI Advisor** - that classifies findings, explains what each application actually does, and writes its analysis back into the BOM itself. Blueprint (alpha) produces only a draft CycloneDX 2.0 Architectural BOM + Bill of Behaviors; it doesn't have an analysis report yet. - -It doesn't scan source code or dependency manifests - it reads what Contrast's agents observed actually running in your applications, with full stack traces, usage counts, and architecture context. +- **Cryptography** - every cryptographic algorithm observed running in your apps/APIs, with NIST post-quantum vulnerability classification. Produces a CBOM and an AI-powered analysis report. +- **AI** - every AI model and provider observed running, with cloud-vs-local classification for shadow-AI visibility. Produces a AIBOM and an AI-powered analysis report +- **Blueprint (alpha)** - a map of how your apps/APIs connect and behave: assets, deployment zones, connections, and crypto/AI behaviors +- **Threat Model** (coming soon) - TBD +- **Vulnerability Exclusion** - an analysis of library CVE exposure in your apps/APIs, based Contrast's runtime library-usage and CVE Shield data. Produces a VEX document and an AI-powered analysis report. **Requirements:** - A Contrast account with runtime data already flowing in from real-world applications and APIs - Contrast's agents must actually be deployed and observing traffic. Runtime Analyst only reports on what Contrast has observed; it has nothing to show against an account with no instrumented applications or no production/QA traffic. -- Java 17+ and Maven to build. - The `claude` CLI on your `PATH` and logged in, for `--analyze`/the advisor reports - no separate API key, no AWS/Bedrock credentials, no Python. -One jar, one command per report type. - -## Why Contrast for This? +## Why Contrast? Contrast provides runtime observability that goes far beyond static code scanning or self-reported inventories: @@ -31,36 +26,11 @@ Contrast provides runtime observability that goes far beyond static code scannin - **Application dependencies** - Which apps and APIs depend on each crypto algorithm or AI model - **Real connections, not guesses** - Blueprint's assets, zones, and flows come from the same architecture graph, so the map it draws is what Contrast actually saw talking to what, not an inferred or self-reported topology -This runtime visibility is critical for post-quantum migration and AI governance planning - you need to know not just *what's* in use, but *how* it's being used and by *what*. - -## `--help` - -``` -$ java -jar runtime-analyst.jar - -Runtime Analyst - Contrast Security Bill of Materials generator - -Usage: - java -jar runtime-analyst.jar auth [options] Connect to Contrast and generate contrast.properties - java -jar runtime-analyst.jar cbom [options] Generate a Cryptography Bill of Materials - java -jar runtime-analyst.jar aibom [options] Generate an AI/LLM usage Bill of Materials - java -jar runtime-analyst.jar blueprint [options] Generate a CycloneDX Blueprint (ABOM + Bill of Behaviors) - java -jar runtime-analyst.jar cbom-advisor Re-run the Quantum Advisor against an existing CBOM - java -jar runtime-analyst.jar aibom-advisor Re-run the AI Advisor against an existing AI-BOM -`cbom --analyze` / `aibom --analyze` already run the matching advisor automatically after generation - -the standalone cbom-advisor/aibom-advisor commands are for re-running the advisor without regenerating the BOM. - -Run with -h after a subcommand for its options, e.g.: - java -jar runtime-analyst.jar cbom -h - java -jar runtime-analyst.jar aibom -h -``` - -Every subcommand supports `-h`/`--help` for its own options - see [Examples](#examples) below for each one's full help text. ## Authentication -Every command except `auth` itself reads a `contrast.properties` file for credentials. If `cbom`, `aibom`, or `blueprint` don't find one (or the one named with `-c`), they run `auth` for you automatically first, then proceed with the command you actually asked for - so you never have to run `auth` yourself as a separate step. You can also set up `contrast.properties` ahead of time, two ways: +Every command except `auth` itself reads a `contrast.properties` file for credentials. If `cbom`, `aibom`, `blueprint`, or `vex` don't find one (or the one named with `-c`), they run `auth` for you automatically first, then proceed with the command you actually asked for - so you never have to run `auth` yourself as a separate step. You can also set up `contrast.properties` ahead of time, two ways: **Option 1 - `auth` (recommended):** @@ -68,20 +38,9 @@ Every command except `auth` itself reads a `contrast.properties` file for creden java -jar runtime-analyst.jar auth --host https://your-instance.contrastsecurity.com ``` -This opens a real browser window and lets you log in exactly the way you normally would, including SSO/MFA - there's nothing to copy or paste. The window closes as soon as login completes; in the background, it reads your personal API key, service key, and organization ID directly off your account's **User Settings > Your Keys** page, verifies them with a real API call, and writes `contrast.properties` for you. Your session cookie is never read or stored - only the API key and service key that page shows you. - -**Option 2 - create it by hand:** - -```properties -contrast.url=https://your-instance.contrastsecurity.com/api/ns-ui/v1 -contrast.org_id=your-org-id -contrast.auth_header=base64-encoded-email:service-key -contrast.api_key=your-api-key -``` +Every command accepts `-c ` to point at a config file somewhere other than the working directory. -Find these values yourself under **User Settings > Your Keys** in the Contrast UI. `contrast.auth_header` is the base64 encoding of `your-email:your-service-key` (not the service key alone). -Every command accepts `-c ` to point at a config file somewhere other than the working directory. ## Usage @@ -97,10 +56,12 @@ A single jar, dispatched by subcommand: | `cbom` | Generate a Cryptography Bill of Materials | | `aibom` | Generate an AI/LLM usage Bill of Materials | | `blueprint` (alpha) | Generate a draft CycloneDX 2.0 Architectural BOM + Bill of Behaviors | +| `vex` | Generate a CycloneDX VEX for an application's library CVEs | | `cbom-advisor` | Re-run the Quantum Advisor against an existing CBOM file | | `aibom-advisor` | Re-run the AI Advisor against an existing AI-BOM file | +| `vex-advisor` | Re-run the VEX Advisor against an existing VEX file | -`cbom`, `aibom`, and `blueprint` all share the same filter flags: `--app `, `--env `, `--list` (list available applications and exit), `-o ` (output path), and `-c `. `cbom`/`aibom` additionally support `--analyze`, which runs the matching advisor automatically after generation. +`cbom`, `aibom`, `blueprint`, and `vex` all share `--app `, `--env `, `--list` (list available applications and exit), `-o ` (output path), and `-c `. For `cbom`/`aibom`/`blueprint`, `--env` filters which observations are included. For `vex`, `--env` means something more specific: it scopes each claim to that one environment's CVE Shield/exposure status, instead of considering the application's dev/qa/prod combined (see the `vex` policy below) - `--env PRODUCTION` means "not seen/protected in production specifically," not "not seen somewhere across the app." `cbom`/`aibom`/`vex` additionally support `--analyze`, which runs the matching advisor automatically after generation. `vex` also has its own `--vex-accept-after-days ` (see below). ## Examples @@ -109,23 +70,11 @@ A single jar, dispatched by subcommand: ``` $ java -jar runtime-analyst.jar auth -h -Auth - connect runtime-analyst to your Contrast account - -Opens a real browser window, lets you log in (including SSO/MFA) the way you normally -would, then reads your personal API key/service key/org id off User Settings > Your Keys -directly - no manual copy/paste into the terminal. The window closes as soon as login -completes; everything after that runs in a background headless browser. - -Usage: - java -jar runtime-analyst.jar auth [--host ] [-o ] -``` - -```bash # First-time setup against your instance -java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com +$ java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com # Write to a different config path -java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com -o prod.properties +$ java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com -o prod.properties ``` ### `cbom` @@ -133,98 +82,71 @@ java -jar runtime-analyst.jar auth --host https://eval.contrastsecurity.com -o p ``` $ java -jar runtime-analyst.jar cbom -h -CBOM Generator - Create CycloneDX CBOM from Contrast observations - -Usage: - java -jar runtime-analyst.jar cbom Generate CBOM for all apps - java -jar runtime-analyst.jar cbom --app Filter by app (ID or name) - java -jar runtime-analyst.jar cbom --env Filter by environment (PRODUCTION, DEVELOPMENT, QA) - java -jar runtime-analyst.jar cbom --list List available applications with IDs - java -jar runtime-analyst.jar cbom --analyze Run Quantum Advisor AI analysis after CBOM generation - java -jar runtime-analyst.jar cbom -o Specify output filename - java -jar runtime-analyst.jar cbom -c Use custom config file -``` - -```bash -java -jar runtime-analyst.jar cbom # all apps -> cbom.json -java -jar runtime-analyst.jar cbom --list # list applications and their IDs -java -jar runtime-analyst.jar cbom --app "MyApp" # filter by app name -java -jar runtime-analyst.jar cbom --app 7136cb1b-f846-4c1d-bdd3-77b448cbd2fe # ...or by ID -java -jar runtime-analyst.jar cbom --env PRODUCTION # only prod observations +java -jar runtime-analyst.jar cbom # all apps -> cbom.json +java -jar runtime-analyst.jar cbom --list # list applications and their IDs +java -jar runtime-analyst.jar cbom --app "MyApp" # filter by app name +java -jar runtime-analyst.jar cbom --app 7136cb1b-f846-4c1d-bdd3-77b448cbd2fe +java -jar runtime-analyst.jar cbom --env PRODUCTION # only prod observations java -jar runtime-analyst.jar cbom --app "MyApp" --env PRODUCTION -o myapp-prod.json java -jar runtime-analyst.jar cbom -c prod.properties --list -java -jar runtime-analyst.jar cbom --analyze # + Quantum Advisor risk report +java -jar runtime-analyst.jar cbom --analyze # + Quantum Advisor risk report ``` -### `aibom` -``` -$ java -jar runtime-analyst.jar aibom -h -AI-BOM Generator - Create CycloneDX AI-BOM from Contrast AI usage observations +### `aibom` -Usage: - java -jar runtime-analyst.jar aibom Generate AI-BOM for all apps - java -jar runtime-analyst.jar aibom --app Filter by app (ID or name) - java -jar runtime-analyst.jar aibom --env Filter by environment (PRODUCTION, DEVELOPMENT, QA) - java -jar runtime-analyst.jar aibom --list List available applications with IDs - java -jar runtime-analyst.jar aibom --analyze Run AI Advisor analysis after AI-BOM generation - java -jar runtime-analyst.jar aibom -o Specify output filename - java -jar runtime-analyst.jar aibom -c Use custom config file ``` +$ java -jar runtime-analyst.jar aibom -h -```bash java -jar runtime-analyst.jar aibom java -jar runtime-analyst.jar aibom --list java -jar runtime-analyst.jar aibom --app "MyApp" --env PRODUCTION -java -jar runtime-analyst.jar aibom --analyze # + AI Advisor governance report +java -jar runtime-analyst.jar aibom --analyze # + AI Advisor governance report ``` -### `blueprint` (alpha) - -``` -$ java -jar runtime-analyst.jar blueprint -h -Blueprint Generator - Create a CycloneDX Blueprint (ABOM + Bill of Behaviors) from Contrast data -Usage: - java -jar runtime-analyst.jar blueprint Generate a Blueprint for all apps - java -jar runtime-analyst.jar blueprint --app Filter by app (ID or name) - java -jar runtime-analyst.jar blueprint --env Filter by environment (PRODUCTION, DEVELOPMENT, QA) - java -jar runtime-analyst.jar blueprint --list List available applications with IDs - java -jar runtime-analyst.jar blueprint -o Specify output filename - java -jar runtime-analyst.jar blueprint -c Use custom config file +### `blueprint` (alpha) -Note: Blueprints are a CycloneDX draft (unreleased 2.0-dev branch, spec PR #652). -This command populates assets/zones/flows/behaviors from real Contrast data only - -it does not generate threats/controls/risks (TM-BOM), which would require fabricating -findings Contrast's telemetry cannot back. ``` +$ java -jar runtime-analyst.jar blueprint -h -```bash java -jar runtime-analyst.jar blueprint java -jar runtime-analyst.jar blueprint --app "MyApp" --env PRODUCTION ``` -### `cbom-advisor` / `aibom-advisor` -Re-run an advisor against a BOM you already have, without regenerating it: -``` -$ java -jar runtime-analyst.jar cbom-advisor -Usage: java -jar runtime-analyst.jar cbom-advisor [-v] [-o report.md] [--json out.json] [--no-confirm] [--filter all|vulnerable|asymmetric] +### `vex` -$ java -jar runtime-analyst.jar aibom-advisor -Usage: java -jar runtime-analyst.jar aibom-advisor [-v] [-o report.md] [--json out.json] [--no-confirm] ``` +$ java -jar runtime-analyst.jar vex -h -```bash -java -jar runtime-analyst.jar cbom-advisor cbom.json -o report.md -java -jar runtime-analyst.jar aibom-advisor aibom.json -o report.md -java -jar runtime-analyst.jar cbom-advisor cbom.json -v -o report.md --filter vulnerable +java -jar runtime-analyst.jar vex --app "MyApp" # -> vex-MyApp.json, considers dev+qa+prod together +java -jar runtime-analyst.jar vex --app "MyApp" --env PRODUCTION # scope every claim to production only +java -jar runtime-analyst.jar vex --list # list applications and their IDs +java -jar runtime-analyst.jar vex --app "MyApp" --vex-accept-after-days 60 -o vex.json +java -jar runtime-analyst.jar vex --app "MyApp" --analyze # + VEX Advisor soundness review ``` -Everything - BOM generation and AI analysis - runs in a single JVM process. The advisors shell out to the `claude` CLI already logged in to this shell; no separate API key or AWS/Bedrock credentials needed, and no Python required. + + +By default a claim considers the application's dev/qa/prod environments together - "protected" means protected in at least one, "not seen" means not seen in any of them. `--env ` narrows every claim to just that one environment instead, so `--env PRODUCTION` means "not seen/protected in production specifically," not "not seen somewhere in the app." An exclusion is generated when: + +1. **Library never loaded at runtime in this application** (`classes_used == 0` for that app) + → `not_affected` +2. **Library loaded, but CVE Shield is actively mitigating it for this application** + → `not_affected` / `protected_at_runtime`. +3. **Library loaded, and this application's CVE status is `EXPOSED`/`EXPLOITED`** + → no VEX statement at all. This tool never suppresses a vulnerability it can't positively account for. +4. **Library loaded, but the CVE has never been observed executing in this application** - a statement is still generated, but *what* it claims depends on whether CVE Shield has a virtual patch for that CVE at all. This is a per-CVE, product-level fact (`cveShieldExists` on the org-wide `/organizations/{org}/cves` endpoint) - not an app- or environment-scoped one, since coverage existing anywhere means it's available everywhere Shield/ADR is enabled: + - Shield covers this CVE and simply hasn't fired → `not_affected` once days observed clears the acceptance threshold, `in_triage` until then - elapsed time is meaningful evidence here, because something was watching. + - Shield has **no coverage at all** for that CVE → `in_triage`, permanently, regardless of days observed. Elapsed time can't turn "no detector was watching" into "nothing happened" - this can never graduate to `not_affected` on duration alone. Earlier versions of this tool tried three different wrong things here: silently dropping these CVEs entirely, marking them `not_affected` anyway once enough days had passed, and inferring "coverage" from a per-app/per-environment `NO_SHIELD` status instead of the org-wide fact - all three were bugs, not policy choices. + +Every statement carries `contrast:*` properties (`classesUsed`/`classCount`, `daysObserved`, `acceptAfterDays`, `envFilter`, and the per-environment `devStatus`/`qaStatus`/`prodStatus`) so a reviewer can see the underlying evidence, not just the resulting state. + + ## Output @@ -270,12 +192,43 @@ A draft CycloneDX 2.0 document with a top-level `blueprints[]` array containing: Deliberately does **not** generate threats, controls, or risks (TM-BOM) - the draft spec models those as a separate, sibling construct, and none of it can be derived from Contrast telemetry without an actual STRIDE-style analysis. +### VEX + +A standard CycloneDX 1.6 document with a top-level `vulnerabilities[]` array, one entry per (application, library, CVE) with: + +- `id` - the CVE identifier, `source` - NVD reference +- `description` - the CVE description, as reported by Contrast +- `ratings[]` - CVSS v3.1 score/severity/vector as reported by Contrast +- `advisories[]` - any reference URLs Contrast has on file for the CVE (omitted when there are none) +- `affects[].ref` - a best-effort `pkg:maven/...` purl for the affected library +- `affects[].versions[]` - the deployed version (`affected`) and, when Contrast has upgrade guidance for the library, the recommended fixed version (`unaffected`) +- `recommendation` - the remediation action: Contrast's own minimal-upgrade guidance for the library when available, falling back to "no newer release identified" when it isn't +- `analysis.state`/`analysis.justification`/`analysis.detail` - the VEX claim itself and why it was made (see the policy in the [`vex` examples](#vex) above) +- `analysis.response[]` - `update` when a fix version is known, `workaround_available` for `protected_at_runtime` claims (the active CVE Shield control **is** the workaround), omitted otherwise +- `properties[]` - the underlying evidence (`contrast:classesUsed`/`classCount`, `contrast:daysObserved`, `contrast:acceptAfterDays`, `contrast:devStatus`/`qaStatus`/`prodStatus`, `contrast:latestVersion`) plus exploitability signals (`contrast:epssScore`/`epssPercentile`, `contrast:cisaKev` - CISA Known Exploited Vulnerabilities catalog membership) plus `contrast:shieldAvailable` - whether CVE Shield could catch this specific CVE at all in the environment(s) considered (`"true"`/`"false"`/absent if unknown) + +All of the above is deterministic, pulled directly from Contrast's own CVE/library data - nothing here is AI-generated, since a VEX claim is an attestation and needs to stay auditable back to its source evidence. The EPSS/CISA KEV/Shield-availability signals are new inputs to the **VEX Advisor**'s AI judgment (below), not to the claim itself. + +`contrast:shieldAvailable` is the org-wide `cveShieldExists` flag from `/organizations/{org}/cves`, verbatim - whether Contrast has a virtual patch definition for this CVE at all, a per-CVE product-level fact rather than something that could differ between environments. (An earlier version of this tool tried to infer it from the per-application `cves/issues` endpoint's `NO_SHIELD` status per environment instead - that status is real and does show up per-app/per-env, but coverage itself isn't scoped that way, so the org-wide fact is authoritative.) This isn't just informational - it changes which state a claim can reach (see policy rule 4 above): when Shield has no coverage, the claim stays `in_triage` forever, since elapsed time without a detector watching is not evidence of anything. + +The document also has a top-level `components[]` array with one Application component per app, carrying whether Assess (the module that produces every claim's runtime evidence) and ADR (the classic HTTP-rule-based RASP module, formerly branded "Protect" - a different, older product from CVE Shield) are enabled per environment: `contrast:assessEnabledDev`/`Qa`/`Prod` and `contrast:adrEnabledDev`/`Qa`/`Prod` (`"true"`/`"false"`/`""` - empty means no agent was ever seen reporting from that environment, which is a different fact from "disabled"). + +``` +Contrast VEX +└── SAML-PetClinic-Demo + ├── CVE-2018-14721 (jackson-databind 2.8.8) → not_affected / code_not_reachable + └── CVE-2022-22965 (spring-webmvc 4.3.9) → not_affected (288 days, no observed execution) +``` + +Note: `PROTECTED_AT_RUNTIME` (CVE Shield actively mitigating) is implemented but not yet confirmed against a live example with that status - see the caveats in the `vex` command's own help/design notes before relying on it. + ### Advisor reports - **Quantum Advisor** - findings grouped by risk level (CRITICAL/HIGH/MEDIUM/LOW/NOT_QUANTUM_ISSUE), with an "Application Context" section describing each app from its architecture graph data - **AI Advisor** - organized as an inventory of AI-enabled applications (one section per app, not per finding): an AI-generated description of what the app does, then each AI usage instance with model/provider/endpoint and a description of what that specific call is doing, inferred from the key methods around it in the stack trace +- **VEX Advisor** - not a second opinion on whether a CVE exists (Contrast's runtime data already establishes that), but a soundness check on whether each `not_affected`/`in_triage` claim is safe to rely on given the CVE's severity/exploitability. Which claims need review is decided **deterministically**, not by an AI call - CRITICAL/HIGH severity, CISA KEV listing, EPSS ≥ 0.5, or Assess having no runtime data to back the claim are all plain facts already sitting on the VEX, so classifying 235 statements one-by-one over an AI round-trip added minutes of latency and cost without adding judgment, and made the same VEX produce a different flagged count from run to run on identical input (21, 61, 125 in one session) - a real liability for something meant to be relied on. The single AI call per app is used only for the narrative (a 2-3 sentence description, risk level, risk rationale, and recommendation, given the already-decided flagged list) - turning facts into prose, not deciding what the facts are. This cut the advisor's typical run from ~8 minutes and ~30,000 output tokens down to under 30 seconds and ~2,000. The report opens with a summary (coverage + computed key findings: flagged-claim count, distinct KEV/high-EPSS CVEs among them, CRITICAL/HIGH apps) before the per-application detail, and lists every claim in one compressed table per app (`CVE | Library | Score | VEX | Shield | Rationale`, e.g. `Yes` / `CVE Not Used 288d` or `No` / `CVE Not Used 288d` - decoded in a legend) instead of a full-sentence rationale repeated per claim. The **Shield** column is `contrast:shieldAvailable` - `No` means the claim rests entirely on absence-of-execution with no possible active backstop, which is materially weaker than the same claim where Shield exists and simply hasn't fired (and CVEs with `No` here never actually reach the VEX at all - see the `vex` command's policy above). Rows sort CISA KEV-listed first, then by EPSS, then by CVSS score, so the claims worth a second look surface at the top. Each app's section also shows a **Protection Status** line (Assess/ADR enablement per environment, from the VEX's own `components[]` - see above): a duration-based claim in an environment where Assess has no data isn't weak evidence, it's *no* evidence, and is flagged for review on that basis alone. -Both advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component - this happens automatically as part of every run, no separate step needed. +Both the Quantum and AI Advisors write their generated application descriptions back into the source BOM's `Component.description` field, so the BOM itself stays self-describing even without the report. The Quantum Advisor also writes `quantum:*` risk properties (risk level, recommendation, code source, etc.) back onto each crypto algorithm component. The VEX Advisor writes `contrast:vexAdvisorAssessment` (`sound`/`needs_review`) and `contrast:vexAdvisorRationale` back onto each vulnerability's `properties[]`. All of this happens automatically as part of every `--analyze` run, no separate step needed. ## BOM Viewer @@ -292,6 +245,19 @@ Two sample AI-BOM files are included to try it with: - `sample-aibom.json` - real output from `AIBOMGenerator` against a live org (one model, both apps local/self-hosted) - `test-aibom.json` - a hand-crafted fixture covering cases the sample doesn't: multiple providers (OpenAI/Anthropic/Ollama), both cloud and local host categories, and an app with multiple call sites for the same model +## Sample Reports + +`samples/` has one real, current output from each generator and its matching advisor report - useful as a reference for what each format actually looks like without running the tool yourself: + +| CycloneDX document | Advisor report | Scoped to | +|---|---|---| +| `sample-cbom.json` | `sample-cbom-advisor.md` | `Cargo-Crypto-contrast-cargo-cats-frontgateservice` | +| `sample-aibom.json` | `sample-aibom-advisor.md` | `Robert-cargocats-aiservice` | +| `sample-blueprint.json` | *(no advisor - see the Blueprint section above)* | `Cargo-Crypto-contrast-cargo-cats-frontgateservice` | +| `sample-vex.json` | `sample-vex-advisor.md` | `SAML-PetClinic-Demo` | + +Each is scoped with `--app` to one application rather than the whole org (smaller, more readable files, and a full-org VEX run makes one CVE-issues API call per application). They're deliberately *not* all the same app - in this org, crypto usage, AI usage, and vulnerable libraries happen to show up in three disjoint sets of applications, so no single app would produce non-empty output for all four generators. Each sample uses whichever app actually has real data for that report type. + ## Configuration Reference | Property | Description | diff --git a/samples/sample-aibom-advisor.md b/samples/sample-aibom-advisor.md new file mode 100644 index 0000000..7f3e77c --- /dev/null +++ b/samples/sample-aibom-advisor.md @@ -0,0 +1,85 @@ + + +# Contrast AI Advisor +## Inventory of AI-Enabled Applications + +--- + +**Client:** Robert-cargocats-aiservice +**Report Date:** September 2, 2026 +**Assessment Type:** Runtime AI/LLM Usage Inventory & Governance Risk Assessment + +--- + +## Executive Summary + +This report inventories every AI/LLM model and provider observed actually running in production across your applications - the model, provider, destination endpoint, and real call stack behind each usage, captured by Contrast Security's runtime instrumentation. + +**1** application(s) use AI, calling **1** distinct model(s) across **1** provider(s), for **1** total usage instance(s). + +> No applications were flagged CRITICAL or HIGH risk for their AI usage. + +### Applications + +| Application | Risk Level | Models Used | +|-------------|------------|--------------| +| Robert-cargocats-aiservice | LOW | `smollm2:135m-tuned` | + +### Models & Providers + +| Provider | Model | Host Category | Applications | Invocations | +|----------|-------|----------------|---------------|-------------| +| openai | `smollm2:135m-tuned` | local | 1 | 2 | + +- **1** model(s) self-hosted/local (no external data egress) + +| Risk Level | Applications | +|------------|--------------| +| LOW | 1 | + +--- + +## Application Inventory + +### Robert-cargocats-aiservice + +**Risk Level:** LOW + +**Language:** JAVA | **Posture Score:** 7.4 (HIGH) | **Open Issues:** 7 | **Connects To:** Robert-cargocats-frontgateservice + +Robert-cargocats-aiservice is a Java Spring Boot microservice that appears to provide AI/chat functionality as a backend for the Robert-cargocats-frontgateservice gateway. It exposes an endpoint that accepts requests and forwards them to a language model via an OpenAI-compatible client, acting as an internal AI integration layer within the CargoCats application suite. + +**Risk Rationale:** The model (smollm2:135m-tuned) is served locally via Ollama at an internal hostname, so no data leaves the environment to a third-party provider. This is self-hosted inference reachable only from an internal gateway service, which limits data exposure risk even though the call path is a straightforward, unauthenticated-looking pass-through. + +**Recommendation:** Confirm the /openai endpoint has appropriate authentication and input validation, and add monitoring/logging for prompt content to catch any sensitive data being passed through, since local hosting reduces but doesn't eliminate governance blind spots. + +#### AI Usage + +| Attribute | Value | +|-----------|-------| +| **Model** | `smollm2:135m-tuned` | +| **Provider** | openai | +| **Endpoint** | `http://ollama:11434/v1` | +| **Host Category** | local | +| **Route** | unknown | +| **Frequency (model-wide)** | Very Low (2 invocations across all apps using this model) | +| **Reachability (this app)** | 1 code path(s) in this application | + +**What it's doing:** AiController.openai handles an incoming request and delegates to AiService.chat, which calls the OpenAI-compatible ChatCompletionService.create client method against a local Ollama instance. This generates a chat completion response for the controller's endpoint, likely relaying a user or gateway-supplied prompt to the locally hosted model. + +--- + +## Appendix: Methodology + +AI/LLM usage data collected via Contrast Security runtime instrumentation. Application descriptions and connection data are derived from the Contrast architecture graph (application, server, and library relationships); AI usage descriptions are inferred from the real stack trace captured at each call site. + +- **CRITICAL**: Likely sensitive/regulated data sent to an unvetted third-party model +- **HIGH**: Production cloud AI usage without an apparent governance process +- **MEDIUM**: Approved-looking usage lacking monitoring, or non-production usage that could reach production +- **LOW**: Local/self-hosted usage or clearly low-sensitivity usage +- **NOT_AI_RISK_ISSUE**: Benign, well-governed usage with no identifiable risk signal + +--- + +*Report generated by Contrast AI Advisor* +*Powered by Contrast Security Runtime Observability* diff --git a/samples/sample-aibom.json b/samples/sample-aibom.json new file mode 100644 index 0000000..b9031ea --- /dev/null +++ b/samples/sample-aibom.json @@ -0,0 +1,114 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:736dae4b-836e-4f0a-a706-3a5d9519923b", + "version": 1, + "metadata": { + "timestamp": "2026-09-02T21:55:47Z", + "component": { + "type": "application", + "bom-ref": "robert-cargocats-aiservice", + "name": "Robert-cargocats-aiservice", + "version": "1.0" + } + }, + "components": [ + { + "type": "machine-learning-model", + "bom-ref": "ai-openai-smollm2-135m-tuned", + "publisher": "openai", + "name": "smollm2:135m-tuned", + "properties": [ + { + "name": "contrast:usageCount", + "value": "2" + }, + { + "name": "contrast:uniqueLocations", + "value": "1" + }, + { + "name": "contrast:provider", + "value": "openai" + }, + { + "name": "contrast:endpoint", + "value": "http://ollama:11434/v1" + }, + { + "name": "contrast:hostCategory", + "value": "local" + } + ], + "evidence": { + "occurrences": [ + { + "location": "com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt)", + "additionalContext": "App: Robert-cargocats-aiservice Stack Trace: com.openai.services.blocking.chat.ChatCompletionServiceImpl$WithRawResponseImpl.create(ChatCompletionServiceImpl.kt) com.openai.services.blocking.chat.ChatCompletionServiceImpl.create(ChatCompletionServiceImpl.kt:63) com.openai.services.blocking.chat.ChatCompletionService.create(ChatCompletionService.kt:64) com.contrast.aiservice.AiService.chat(AiService.java:54) com.contrast.aiservice.AiController.openai(AiController.java:30) java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) java.base/java.lang.reflect.Method.invoke(Unknown Source) org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:258) org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:191) org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:118) org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:986) org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:891) org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1089) org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979) org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014) org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:903) jakarta.servlet.http.HttpServlet.service(HttpServlet.java:564) org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:885) jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:195) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483) org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:116) org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:732) org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:398) org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:903) org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1740) org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1189) org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:658) org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) java.base/java.lang.Thread.run(Unknown Source)" + } + ] + } + }, + { + "type": "application", + "bom-ref": "app-robert-cargocats-aiservice", + "name": "Robert-cargocats-aiservice", + "externalReferences": [ + { + "type": "runtime-analysis-report", + "url": "https://eval.contrastsecurity.com/Contrast/cs/index.html#/6a3073a5-5e68-40e5-9d7d-165340fff15a/explorer?detailsId\u003d-606870275\u0026applicationId\u003d5e888a9b-a094-490a-ab35-01eec6afcb50", + "comment": "Contrast Application Explorer" + } + ], + "properties": [ + { + "name": "contrast:language", + "value": "JAVA" + }, + { + "name": "contrast:postureScore", + "value": "7.4" + }, + { + "name": "contrast:postureSeverity", + "value": "HIGH" + }, + { + "name": "contrast:criticality", + "value": "3" + }, + { + "name": "contrast:openIssuesTotal", + "value": "7" + }, + { + "name": "contrast:serverCount", + "value": "1" + }, + { + "name": "contrast:libraryCount", + "value": "56" + }, + { + "name": "contrast:connectedApplications", + "value": "Robert-cargocats-frontgateservice" + } + ], + "description": "Robert-cargocats-aiservice is a Java Spring Boot microservice that appears to provide AI/chat functionality as a backend for the Robert-cargocats-frontgateservice gateway. It exposes an endpoint that accepts requests and forwards them to a language model via an OpenAI-compatible client, acting as an internal AI integration layer within the CargoCats application suite." + } + ], + "dependencies": [ + { + "ref": "app-robert-cargocats-aiservice", + "dependsOn": [ + "ai-openai-smollm2-135m-tuned" + ] + }, + { + "ref": "robert-cargocats-aiservice", + "dependsOn": [ + "ai-openai-smollm2-135m-tuned" + ] + } + ] +} \ No newline at end of file diff --git a/samples/sample-blueprint.json b/samples/sample-blueprint.json new file mode 100644 index 0000000..f910cdb --- /dev/null +++ b/samples/sample-blueprint.json @@ -0,0 +1,97 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:c0876091-e05b-4bfb-bea5-e76d5c88112b", + "version": 1, + "metadata": { + "timestamp": "2026-09-02T21:56:06.331Z" + }, + "blueprints": [ + { + "bom-ref": "blueprint-1", + "name": "Blueprint - Cargo-Crypto-contrast-cargo-cats-frontgateservice", + "description": "Generated from Contrast runtime observability data: application architecture/connections (contrast-graph) and crypto/AI usage observations, mapped onto the CycloneDX behavior taxonomy. Does not include threats, controls, or risks - see TM-BOM.", + "modelTypes": [ + "architecture", + "behavioral" + ], + "assets": [ + { + "bom-ref": "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice", + "name": "Cargo-Crypto-contrast-cargo-cats-frontgateservice", + "type": "system", + "zone": "zone-env-development" + }, + { + "bom-ref": "asset-external-robert-cargocats-frontgateservice", + "name": "Robert-cargocats-frontgateservice", + "type": "system", + "description": "Known only as an architecture-graph connection target; no application-level data available." + }, + { + "bom-ref": "asset-external-robert-cargocats-dataservice", + "name": "Robert-cargocats-dataservice", + "type": "system", + "description": "Known only as an architecture-graph connection target; no application-level data available." + }, + { + "bom-ref": "asset-external-robert-cargocats-reportservice", + "name": "Robert-cargocats-reportservice", + "type": "system", + "description": "Known only as an architecture-graph connection target; no application-level data available." + }, + { + "bom-ref": "asset-external-robert-cargocats-aiservice", + "name": "Robert-cargocats-aiservice", + "type": "system", + "description": "Known only as an architecture-graph connection target; no application-level data available." + } + ], + "zones": [ + { + "bom-ref": "zone-env-development", + "name": "DEVELOPMENT", + "type": "deployment" + } + ], + "flows": [], + "behaviors": { + "instances": [ + { + "bom-ref": "behavior-1", + "behavior": "security:cryptography:encryptsData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-2", + "behavior": "security:cryptography:hashesData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-3", + "behavior": "security:cryptography:hashesData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ], + "trigger": "unknown" + }, + { + "bom-ref": "behavior-4", + "behavior": "security:cryptography:hashesData", + "actors": [ + "asset-app-cargo-crypto-contrast-cargo-cats-frontgateservice" + ], + "trigger": "unknown" + } + ] + } + } + ] +} \ No newline at end of file diff --git a/samples/sample-cbom-advisor.md b/samples/sample-cbom-advisor.md new file mode 100644 index 0000000..afc0c81 --- /dev/null +++ b/samples/sample-cbom-advisor.md @@ -0,0 +1,206 @@ + + +# Contrast Quantum Advisor +## Post-Quantum Cryptography Readiness Assessment + +--- + +**Client:** Cargo-Crypto-contrast-cargo-cats-frontgateservice +**Report Date:** September 2, 2026 +**Assessment Type:** Runtime Cryptographic Analysis & Quantum Risk Assessment + +--- + +## Executive Summary + +This assessment inventories every cryptographic algorithm actually observed running in production across your applications - algorithm strength, mode, invocation frequency, and the real call context behind each finding, captured by Contrast Security's runtime instrumentation rather than declared dependencies or static code scanning. + +**1** application(s) use cryptography, calling **4** distinct algorithm(s), for **4** total findings analyzed. + +> No algorithms were flagged as needing post-quantum remediation. + +### Applications + +| Application | Algorithms Used | +|-------------|------------------| +| Cargo-Crypto-contrast-cargo-cats-frontgateservice | `AES/GCM/NoPadding`, `MD5`, `SHA-1`, `SHA-256` | + +### Algorithms + +| Algorithm | Risk Level | Applications | Invocations | +|-----------|------------|---------------|-------------| +| `AES/GCM/NoPadding` | LOW | 1 | 124 | +| `MD5` | NOT_QUANTUM_ISSUE | 1 | 5 | +| `SHA-1` | NOT_QUANTUM_ISSUE | 1 | 1 | +| `SHA-256` | LOW | 1 | 868 | + +- **0** algorithm(s) need post-quantum remediation (CRITICAL/HIGH/MEDIUM) +- **2** algorithm(s) are quantum-safe as-is (LOW) +- **2** algorithm(s) have classical (non-quantum) weaknesses to address separately + +### Application Context + +**Cargo-Crypto-contrast-cargo-cats-frontgateservice** + +Based on its name, this is likely the front gateway service for the "cargo cats" application, probably handling incoming requests and routing them to backend services within that system. It appears to be an isolated or minimally instrumented component, since no connected applications or third-party libraries were observed, which may reflect limited runtime visibility rather than an actual lack of dependencies. + + +### Quantum Risk Overview + +> ✅ **No critical quantum vulnerabilities detected** + +### Code Source Summary + +| Source Type | Count | Remediation Approach | +|-------------|-------|---------------------| +| 🏠 Custom Code | 4 | Direct code change by dev team | + +--- + +## Detailed Findings + +### 🟢 Low Priority (Quantum-Safe) + +#### [LOW] Finding 1: No action needed for SHA-256 usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `SHA-256` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unknown, no stack trace provided` | +| **Remediation Owner** | N/A, no action required | +| **Frequency** | Low (868 invocations) | +| **Reachability** | 1 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, stack trace not provided, likely general data integrity or identifier hashing | +| **Data Lifetime** | unknown (insufficient stack trace detail to determine) | + +**Description:** Application computes SHA-256 hashes, likely for integrity checks, data fingerprinting, or similar purposes. + +**Quantum Threat Analysis:** SHA-256 is a symmetric primitive. Grover's algorithm provides at most a quadratic speedup against hash preimage/collision resistance, reducing effective security from 256 bits to roughly 128 bits, which remains well above the threshold considered secure. SHA-256 is not vulnerable to Shor's algorithm since it is not based on integer factorization or discrete logarithm problems. + +**Recommendation:** No remediation needed for quantum resistance. SHA-256 remains quantum-safe at current and foreseeable quantum computing capabilities. Continue monitoring NIST guidance in case recommendations change. + +**Remediation Plan:** +None required. If this SHA-256 usage is paired with an asymmetric algorithm elsewhere in the same workflow (e.g., signing a hash with RSA/ECDSA), that paired asymmetric operation is the actual quantum risk and should be evaluated separately, not this hash function itself. + +--- + +#### [LOW] Finding 2: No action needed for AES/GCM usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `AES/GCM/NoPadding` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unknown, no stack trace provided to identify the originating package or class` | +| **Remediation Owner** | No remediation required, application team should confirm key size during a routine review | +| **Frequency** | Low (124 invocations) | +| **Reachability** | 1 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, no stack trace or entry point provided to identify what data is being encrypted | +| **Data Lifetime** | short-term | + +**Description:** The application uses AES/GCM/NoPadding for authenticated symmetric encryption. + +**Quantum Threat Analysis:** AES is symmetric crypto, so it's only affected by Grover's algorithm, which halves effective key strength. AES/GCM at 256-bit keys remains secure at roughly AES-128 equivalent strength post-quantum. This is quantum-safe by design as long as a 256-bit key is used. + +**Recommendation:** No replacement needed. Confirm the key size configured for this AES/GCM usage is 256-bit rather than 128-bit, since 128-bit keys drop to roughly 64-bit equivalent strength under Grover's algorithm, which is inadequate for long-term protection. + +**Remediation Plan:** +Verify the key generation code (e.g., KeyGenerator.getInstance("AES").init(256)) uses 256-bit keys. No stack trace was available for this instance, so the exact call site couldn't be confirmed. If this data has a long retention period, treat that as a separate finding requiring key-size verification, not a post-quantum migration issue. + +--- + +### ⚪ Non-Quantum Issues + +#### [NOT_QUANTUM_ISSUE] Finding 3: Replace SHA-1 in cargo-cats-frontgateservice (classical break, not quantum) + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `SHA-1` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unknown, no stack trace provided in this observation` | +| **Remediation Owner** | Application development team for cargo-cats-frontgateservice | +| **Frequency** | Very Low (1 invocations) | +| **Reachability** | 1 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown, no stack trace available to determine what data is being hashed | +| **Data Lifetime** | short-term | + +**Description:** Application computes a SHA-1 hash, purpose unclear due to missing stack trace and entry point details + +**Quantum Threat Analysis:** SHA-1 is a symmetric/hash primitive. Grover's algorithm only provides a quadratic speedup against hash preimage attacks, so SHA-1's quantum-adjusted strength would still be roughly 80 bits if it were otherwise sound. The real problem is that SHA-1 is already classically broken via practical collision attacks (e.g., SHAttered), which have nothing to do with quantum computing. + +**Recommendation:** Treat this as a standard cryptographic hygiene finding, not a post-quantum migration item. Replace SHA-1 with SHA-256 or SHA-3-256 for any integrity, signature, or fingerprinting use. If SHA-1 is being used for password hashing, switch to a dedicated password hashing function such as bcrypt, scrypt, or Argon2 instead of a general-purpose hash. + +**Remediation Plan:** +This finding is missing its stack trace and entry point, so the exact call site and use case (checksum, signature digest, password hash, cache key, etc.) can't be confirmed. Pull the full observation details from Contrast to identify the calling code before making changes, since the fix differs depending on whether SHA-1 is used for integrity checking versus password storage. + +--- + +#### [NOT_QUANTUM_ISSUE] Finding 4: Replace MD5 hashing in Cargo-Crypto-contrast-cargo-cats-frontgateservice + +| Attribute | Value | +|-----------|-------| +| **Algorithm** | `MD5` | +| **Application** | Cargo-Crypto-contrast-cargo-cats-frontgateservice | +| **Code Source** | 🏠 Custom Code | +| **Source Package** | `Unknown - stack trace not provided in this observation` | +| **Remediation Owner** | Application development team (assumed custom_code based on naming; verify actual call site once stack trace is available) | +| **Frequency** | Very Low (5 invocations) | +| **Reachability** | 1 code path(s) invoke this algorithm | +| **Data Sensitivity** | Unknown - no stack trace context available to determine what data is being hashed | +| **Data Lifetime** | unknown | + +**Description:** Application uses MD5 hashing, observed 5 times, with no stack trace or entry point provided to determine the specific purpose. + +**Quantum Threat Analysis:** MD5 is classically broken (collision attacks are practical today) but this is not a quantum-specific vulnerability. Grover's algorithm would only provide a quadratic speedup against a preimage attack, and MD5 is already broken well beyond that by classical cryptanalysis. This should be tracked as a standard cryptographic weakness, not a post-quantum migration item. + +**Recommendation:** Replace MD5 with SHA-256 or SHA-3 for any integrity, hashing, or fingerprinting use case. If MD5 is being used for password storage, replace it with a proper password hashing function (bcrypt, scrypt, or Argon2) instead. This is unrelated to quantum readiness and should be prioritized as a classical cryptographic hygiene fix. + +**Remediation Plan:** +No stack trace or entry point was provided with this finding, so the exact call site and purpose (integrity check, password hashing, cache key, deduplication, etc.) can't be confirmed. Recommend re-pulling observation details (GET /observations/{id}/details) to get the stack trace before assigning to a team, since the fix differs significantly if this turns out to be password storage versus a non-security checksum use. + +--- + +## Appendix A: Algorithm Risk Matrix + +| Algorithm | Quantum Risk | Remediation Timeline | +|-----------|--------------|----------------------| +| `SHA-256` | 🟢 LOW | ✅ No action needed | +| `AES/GCM/NoPadding` | 🟢 LOW | ✅ No action needed | +| `SHA-1` | ⚪ NOT_QUANTUM_ISSUE | 🔧 Classical security fix | +| `MD5` | ⚪ NOT_QUANTUM_ISSUE | 🔧 Classical security fix | + +--- + +## Appendix B: Methodology + +### Quantum Threat Model + +This assessment evaluates cryptographic algorithms against two primary quantum computing threats: + +| Threat | Impact | Affected Algorithms | +|--------|--------|---------------------| +| **Shor's Algorithm** | Complete break of asymmetric crypto | RSA, ECDSA, ECDH, DH, DSA | +| **Grover's Algorithm** | Halves effective key length | AES, SHA (still safe at 256-bit) | + +### Risk Classification Criteria + +- **CRITICAL**: Asymmetric cryptography protecting long-term secrets, digital signatures, or stored data +- **HIGH**: Asymmetric cryptography for sensitive data with medium-term exposure +- **MEDIUM**: Asymmetric cryptography with forward secrecy mitigations +- **LOW**: Symmetric cryptography with sufficient key sizes (quantum-resistant) +- **NOT_QUANTUM_ISSUE**: Classical cryptographic weaknesses unrelated to quantum threats + +### Data Sources + +Cryptographic usage data collected via Contrast Security runtime instrumentation, providing: +- Actual algorithms in use (not just declared dependencies) +- Complete call stack context for usage classification +- Invocation frequency and code path reachability metrics + +--- + +*Report generated by Contrast Quantum Advisor* +*Powered by Contrast Security Runtime Observability* diff --git a/samples/sample-cbom.json b/samples/sample-cbom.json new file mode 100644 index 0000000..9af3908 --- /dev/null +++ b/samples/sample-cbom.json @@ -0,0 +1,388 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "serialNumber": "urn:uuid:9dbc0165-69f6-4e9f-a3a3-65d529d28dde", + "version": 1, + "metadata": { + "timestamp": "2026-09-02T21:54:40Z", + "component": { + "type": "application", + "bom-ref": "cargo-crypto-contrast-cargo-cats-frontgateservice", + "name": "Cargo-Crypto-contrast-cargo-cats-frontgateservice", + "version": "1.0" + }, + "properties": [ + { + "name": "quantum:enhancedAt", + "value": "2026-09-02T17:55:43.336882" + }, + { + "name": "quantum:enhancedBy", + "value": "Contrast Quantum Advisor" + } + ] + }, + "components": [ + { + "type": "cryptographic-asset", + "bom-ref": "crypto-sha-1", + "name": "SHA-1", + "properties": [ + { + "name": "contrast:usageCount", + "value": "1" + }, + { + "name": "contrast:uniqueLocations", + "value": "1" + }, + { + "name": "quantum:riskLevel", + "value": "NOT_QUANTUM_ISSUE" + }, + { + "name": "quantum:title", + "value": "Replace SHA-1 in cargo-cats-frontgateservice (classical break, not quantum)" + }, + { + "name": "quantum:usageSummary", + "value": "Application computes a SHA-1 hash, purpose unclear due to missing stack trace and entry point details" + }, + { + "name": "quantum:dataSensitivity", + "value": "Unknown, no stack trace available to determine what data is being hashed" + }, + { + "name": "quantum:dataLifetime", + "value": "short-term" + }, + { + "name": "quantum:codeSource", + "value": "custom_code" + }, + { + "name": "quantum:sourcePackage", + "value": "Unknown, no stack trace provided in this observation" + }, + { + "name": "quantum:remediationOwner", + "value": "Application development team for cargo-cats-frontgateservice" + }, + { + "name": "quantum:quantumThreat", + "value": "SHA-1 is a symmetric/hash primitive. Grover\u0027s algorithm only provides a quadratic speedup against hash preimage attacks, so SHA-1\u0027s quantum-adjusted strength would still be roughly 80 bits if it were otherwise sound. The real problem is that SHA-1 is already classically broken via practical collision attacks (e.g., SHAttered), which have nothing to do with quantum computing." + }, + { + "name": "quantum:recommendation", + "value": "Treat this as a standard cryptographic hygiene finding, not a post-quantum migration item. Replace SHA-1 with SHA-256 or SHA-3-256 for any integrity, signature, or fingerprinting use. If SHA-1 is being used for password hashing, switch to a dedicated password hashing function such as bcrypt, scrypt, or Argon2 instead of a general-purpose hash." + }, + { + "name": "quantum:migrationNotes", + "value": "This finding is missing its stack trace and entry point, so the exact call site and use case (checksum, signature digest, password hash, cache key, etc.) can\u0027t be confirmed. Pull the full observation details from Contrast to identify the calling code before making changes, since the fix differs depending on whether SHA-1 is used for integrity checking versus password storage." + }, + { + "name": "quantum:findingsAnalyzed", + "value": "1" + } + ], + "evidence": { + "occurrences": [ + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" + } + ] + }, + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "hash", + "parameterSetIdentifier": "160", + "cryptoFunctions": [ + "digest" + ], + "classicalSecurityLevel": 80, + "nistQuantumSecurityLevel": 1 + }, + "oid": "1.3.14.3.2.26" + } + }, + { + "type": "cryptographic-asset", + "bom-ref": "crypto-sha-256", + "name": "SHA-256", + "properties": [ + { + "name": "contrast:usageCount", + "value": "868" + }, + { + "name": "contrast:uniqueLocations", + "value": "1" + }, + { + "name": "quantum:riskLevel", + "value": "LOW" + }, + { + "name": "quantum:title", + "value": "No action needed for SHA-256 usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice" + }, + { + "name": "quantum:usageSummary", + "value": "Application computes SHA-256 hashes, likely for integrity checks, data fingerprinting, or similar purposes." + }, + { + "name": "quantum:dataSensitivity", + "value": "Unknown, stack trace not provided, likely general data integrity or identifier hashing" + }, + { + "name": "quantum:dataLifetime", + "value": "unknown (insufficient stack trace detail to determine)" + }, + { + "name": "quantum:codeSource", + "value": "custom_code" + }, + { + "name": "quantum:sourcePackage", + "value": "Unknown, no stack trace provided" + }, + { + "name": "quantum:remediationOwner", + "value": "N/A, no action required" + }, + { + "name": "quantum:quantumThreat", + "value": "SHA-256 is a symmetric primitive. Grover\u0027s algorithm provides at most a quadratic speedup against hash preimage/collision resistance, reducing effective security from 256 bits to roughly 128 bits, which remains well above the threshold considered secure. SHA-256 is not vulnerable to Shor\u0027s algorithm since it is not based on integer factorization or discrete logarithm problems." + }, + { + "name": "quantum:recommendation", + "value": "No remediation needed for quantum resistance. SHA-256 remains quantum-safe at current and foreseeable quantum computing capabilities. Continue monitoring NIST guidance in case recommendations change." + }, + { + "name": "quantum:migrationNotes", + "value": "None required. If this SHA-256 usage is paired with an asymmetric algorithm elsewhere in the same workflow (e.g., signing a hash with RSA/ECDSA), that paired asymmetric operation is the actual quantum risk and should be evaluated separately, not this hash function itself." + }, + { + "name": "quantum:findingsAnalyzed", + "value": "1" + } + ], + "evidence": { + "occurrences": [ + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" + } + ] + }, + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "hash", + "parameterSetIdentifier": "256", + "cryptoFunctions": [ + "digest" + ], + "classicalSecurityLevel": 128, + "nistQuantumSecurityLevel": 3 + }, + "oid": "2.16.840.1.101.3.4.2.1" + } + }, + { + "type": "cryptographic-asset", + "bom-ref": "crypto-md5", + "name": "MD5", + "properties": [ + { + "name": "contrast:usageCount", + "value": "5" + }, + { + "name": "contrast:uniqueLocations", + "value": "1" + }, + { + "name": "quantum:riskLevel", + "value": "NOT_QUANTUM_ISSUE" + }, + { + "name": "quantum:title", + "value": "Replace MD5 hashing in Cargo-Crypto-contrast-cargo-cats-frontgateservice" + }, + { + "name": "quantum:usageSummary", + "value": "Application uses MD5 hashing, observed 5 times, with no stack trace or entry point provided to determine the specific purpose." + }, + { + "name": "quantum:dataSensitivity", + "value": "Unknown - no stack trace context available to determine what data is being hashed" + }, + { + "name": "quantum:dataLifetime", + "value": "unknown" + }, + { + "name": "quantum:codeSource", + "value": "custom_code" + }, + { + "name": "quantum:sourcePackage", + "value": "Unknown - stack trace not provided in this observation" + }, + { + "name": "quantum:remediationOwner", + "value": "Application development team (assumed custom_code based on naming; verify actual call site once stack trace is available)" + }, + { + "name": "quantum:quantumThreat", + "value": "MD5 is classically broken (collision attacks are practical today) but this is not a quantum-specific vulnerability. Grover\u0027s algorithm would only provide a quadratic speedup against a preimage attack, and MD5 is already broken well beyond that by classical cryptanalysis. This should be tracked as a standard cryptographic weakness, not a post-quantum migration item." + }, + { + "name": "quantum:recommendation", + "value": "Replace MD5 with SHA-256 or SHA-3 for any integrity, hashing, or fingerprinting use case. If MD5 is being used for password storage, replace it with a proper password hashing function (bcrypt, scrypt, or Argon2) instead. This is unrelated to quantum readiness and should be prioritized as a classical cryptographic hygiene fix." + }, + { + "name": "quantum:migrationNotes", + "value": "No stack trace or entry point was provided with this finding, so the exact call site and purpose (integrity check, password hashing, cache key, deduplication, etc.) can\u0027t be confirmed. Recommend re-pulling observation details (GET /observations/{id}/details) to get the stack trace before assigning to a team, since the fix differs significantly if this turns out to be password storage versus a non-security checksum use." + }, + { + "name": "quantum:findingsAnalyzed", + "value": "1" + } + ], + "evidence": { + "occurrences": [ + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" + } + ] + }, + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "hash", + "parameterSetIdentifier": "128", + "cryptoFunctions": [ + "digest" + ], + "nistQuantumSecurityLevel": 0 + }, + "oid": "1.2.840.113549.2.5" + } + }, + { + "type": "cryptographic-asset", + "bom-ref": "crypto-aes-gcm-nopadding", + "name": "AES/GCM/NoPadding", + "properties": [ + { + "name": "contrast:usageCount", + "value": "124" + }, + { + "name": "contrast:uniqueLocations", + "value": "1" + }, + { + "name": "quantum:riskLevel", + "value": "LOW" + }, + { + "name": "quantum:title", + "value": "No action needed for AES/GCM usage in Cargo-Crypto-contrast-cargo-cats-frontgateservice" + }, + { + "name": "quantum:usageSummary", + "value": "The application uses AES/GCM/NoPadding for authenticated symmetric encryption." + }, + { + "name": "quantum:dataSensitivity", + "value": "Unknown, no stack trace or entry point provided to identify what data is being encrypted" + }, + { + "name": "quantum:dataLifetime", + "value": "short-term" + }, + { + "name": "quantum:codeSource", + "value": "custom_code" + }, + { + "name": "quantum:sourcePackage", + "value": "Unknown, no stack trace provided to identify the originating package or class" + }, + { + "name": "quantum:remediationOwner", + "value": "No remediation required, application team should confirm key size during a routine review" + }, + { + "name": "quantum:quantumThreat", + "value": "AES is symmetric crypto, so it\u0027s only affected by Grover\u0027s algorithm, which halves effective key strength. AES/GCM at 256-bit keys remains secure at roughly AES-128 equivalent strength post-quantum. This is quantum-safe by design as long as a 256-bit key is used." + }, + { + "name": "quantum:recommendation", + "value": "No replacement needed. Confirm the key size configured for this AES/GCM usage is 256-bit rather than 128-bit, since 128-bit keys drop to roughly 64-bit equivalent strength under Grover\u0027s algorithm, which is inadequate for long-term protection." + }, + { + "name": "quantum:migrationNotes", + "value": "Verify the key generation code (e.g., KeyGenerator.getInstance(\"AES\").init(256)) uses 256-bit keys. No stack trace was available for this instance, so the exact call site couldn\u0027t be confirmed. If this data has a long retention period, treat that as a separate finding requiring key-size verification, not a post-quantum migration issue." + }, + { + "name": "quantum:findingsAnalyzed", + "value": "1" + } + ], + "evidence": { + "occurrences": [ + { + "additionalContext": "App: Cargo-Crypto-contrast-cargo-cats-frontgateservice" + } + ] + }, + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "ae", + "parameterSetIdentifier": "128", + "mode": "gcm", + "padding": "raw", + "cryptoFunctions": [ + "encrypt", + "decrypt", + "keygen" + ], + "classicalSecurityLevel": 128, + "nistQuantumSecurityLevel": 1 + }, + "oid": "2.16.840.1.101.3.4.1.6" + } + }, + { + "type": "application", + "bom-ref": "app-cargo-crypto-contrast-cargo-cats-frontgateservice", + "name": "Cargo-Crypto-contrast-cargo-cats-frontgateservice", + "description": "Based on its name, this is likely the front gateway service for the \"cargo cats\" application, probably handling incoming requests and routing them to backend services within that system. It appears to be an isolated or minimally instrumented component, since no connected applications or third-party libraries were observed, which may reflect limited runtime visibility rather than an actual lack of dependencies." + } + ], + "dependencies": [ + { + "ref": "app-cargo-crypto-contrast-cargo-cats-frontgateservice", + "dependsOn": [ + "crypto-sha-1", + "crypto-sha-256", + "crypto-aes-gcm-nopadding", + "crypto-md5" + ] + }, + { + "ref": "cargo-crypto-contrast-cargo-cats-frontgateservice", + "dependsOn": [ + "crypto-sha-1", + "crypto-sha-256", + "crypto-md5", + "crypto-aes-gcm-nopadding" + ] + } + ] +} \ No newline at end of file diff --git a/samples/sample-vex-advisor.md b/samples/sample-vex-advisor.md new file mode 100644 index 0000000..505746a --- /dev/null +++ b/samples/sample-vex-advisor.md @@ -0,0 +1,323 @@ + + +# Contrast VEX Advisor +## Review of Automatically-Generated VEX Claims + +--- + +**Report Date:** September 3, 2026 +**Assessment Type:** VEX Claim Soundness Review + +--- + +## Summary + +This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast Security runtime library-usage and CVE Shield data. It does not re-derive whether a CVE exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely on as-is, or whether a human should look at it first. + +**Coverage:** 1 application(s), 235 VEX statement(s) reviewed. + +**Key Findings:** + +- **125 of 235 claim(s) flagged for human review** before relying on them. +- **7 flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - actively exploited in the wild: CVE-2018-1273, CVE-2022-22965, CVE-2025-24813, CVE-2020-1938, CVE-2017-12617, CVE-2023-44487. +- **11 flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): CVE-2017-17485, CVE-2024-38819, CVE-2019-0232, CVE-2019-0199, CVE-2025-55752, CVE-2019-10072 (+5 more). +- Application(s) rated CRITICAL/HIGH risk: SAML-PetClinic-Demo. + +### Applications + +| Application | Risk Level | Statements | +|-------------|------------|------------| +| SAML-PetClinic-Demo | CRITICAL | 235 | + +| Risk Level | Applications | +|------------|--------------| +| CRITICAL | 1 | + +### Legend + +**VEX** - `NA` = not_affected, `IT` = in_triage + +**Shield** - whether CVE Shield has a virtual patch for this specific CVE at all (a per-CVE, product-level fact - coverage existing anywhere means it's available everywhere Shield is enabled): `Yes` (Shield covers it, even if it hasn't fired), `No` (no Shield coverage for this CVE at all - the claim rests entirely on absence-of-execution, with no possible active backstop), `-` (unknown). + +**Rationale** - why the claim was made, with the day count for the two duration-based reasons: + +| Rationale | Meaning | +|-----------|---------| +| `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based | +| `CVE Shielded` | CVE Shield actively mitigating at runtime - an active control, not time-based | +| `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold | +| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold - may still graduate to `CVE Not Used` | + +CVEs with no CVE Shield coverage at all never appear in this table - VEXGenerator excludes them entirely rather than claiming `not_affected` or `in_triage` without a detector ever having watched (see its console output for the excluded count). + +Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth a second look surface at the top - see the Key Findings above for which specific CVEs those are. + +**Protection Status** (shown per app below) - Assess is the module that produces the runtime evidence every claim in this report rests on; ADR (formerly branded "Protect") is the classic HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate product that defends specific CVEs via a microsandbox rather than HTTP rules. Its own coverage is the per-row **Shield** column above - a per-CVE, product-level fact (coverage existing anywhere means it's available everywhere Shield is enabled), not an app- or environment-scoped one. + +--- + +## Application Detail + +### SAML-PetClinic-Demo + +**Risk Level:** CRITICAL + +**Protection Status:** Assess (runtime evidence): dev=enabled, qa=no data, prod=enabled · ADR (classic RASP, formerly "Protect" - not CVE Shield): dev=disabled, qa=no data, prod=enabled + +This VEX set for SAML-PetClinic-Demo covers 235 claims across a stack of badly outdated dependencies (jackson-databind 2.8.8, spring-webmvc/spring-beans/spring-core 4.3.9, tomcat-embed-core 8.5.15, dom4j 1.6.1, hsqldb 2.3.5, thymeleaf 3.0.6, mysql-connector-java 5.1.42, and others). 110 claims look sound, but 125 are flagged, all of them 'not_affected' determinations resting entirely on 288 days of Assess runtime observation with no exploit ever triggering, not on actual remediation. + +**Risk Rationale:** Six of the flagged CVEs are CISA KEV-listed with EPSS at or near 1.0, meaning they're being actively exploited in the wild right now: CVE-2022-22965 (Spring4Shell, on both spring-webmvc and spring-beans), CVE-2018-1273 (spring-data-commons RCE, EPSS 0.97), CVE-2020-1938 (Ghostcat, tomcat-embed-core, EPSS 0.99), CVE-2025-24813 (tomcat-embed-core, EPSS 1.0), CVE-2017-12617 (tomcat-embed-core, EPSS 1.0), and CVE-2023-44487 (HTTP/2 Rapid Reset, EPSS 1.0). Every one of these is marked 'not_affected' purely because Assess never saw the vulnerable code path get hit in 288 days of dev/prod traffic. That's an absence-of-evidence argument on some of the most actively weaponized CVEs in the CVE database, sitting on a jackson-databind version (2.8.8) that alone carries 46 flagged critical/high deserialization CVEs. ADR, the runtime protection module that would actually block exploitation attempts, is disabled in dev and has no data in qa, so these versions have never been stress-tested against real attack traffic in any lower environment. Only prod runs both Assess and ADR, and even there the VEX claims are based on non-observation, not on ADR having intercepted and blocked an attempt. + +**Recommendation:** Before trusting this VEX as-is, get a human to look at the six CISA KEV / high-EPSS claims first: CVE-2022-22965 (Spring4Shell) on spring-webmvc and spring-beans, CVE-2018-1273 on spring-data-commons, CVE-2020-1938 (Ghostcat) and CVE-2025-24813 and CVE-2017-12617 on tomcat-embed-core, and CVE-2023-44487 (Rapid Reset). These need either confirmed compensating controls (WAF rules, ADR blocking rules actively enabled and tested against these specific CVEs) or an actual upgrade plan, not a 'we never saw it happen' justification. Given the age and scale of the outdated dependency set (jackson-databind, spring 4.3.9, tomcat 8.5.15 are all years past end-of-life), treat this whole app as a strong upgrade candidate rather than relying on runtime silence as proof of safety, and confirm ADR is actually enabled and exercised against known KEV payloads in a lower environment before leaning on these VEX claims for a production risk decision. + +| CVE | Library | Score | VEX | Shield | Rationale | +|-----|---------|-------|-----|--------|-----------| +| CVE-2022-22965 | spring-boot-starter-web@1.5.4.RELEASE | 9.8 | NA | Yes | Library Unused | +| CVE-2022-22965 | spring-webmvc@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2022-22965 | spring-beans@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2025-24813 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-12617 | tomcat-embed-core@8.5.15 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2023-44487 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2020-1938 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1273 | spring-data-commons@1.13.4.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2022-1471 | snakeyaml@1.17 | 9.8 | NA | Yes | Library Unused | +| CVE-2019-0232 | tomcat-embed-core@8.5.15 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-11784 | tomcat-embed-core@8.5.15 | 4.3 | NA | Yes | CVE Not Used 288d | +| CVE-2022-34169 | xalan@2.7.2 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-0199 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-10072 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-55752 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-31650 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-48988 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2020-9484 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2024-38819 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2017-17485 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-0221 | tomcat-embed-core@8.5.15 | 6.1 | NA | Yes | CVE Not Used 288d | +| CVE-2019-12384 | jackson-databind@2.8.8 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2024-50379 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-7525 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2022-22950 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1271 | spring-core@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2016-1000027 | spring-web@4.3.9.RELEASE | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-8840 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-18640 | snakeyaml@1.17 | 7.5 | NA | Yes | Library Unused | +| CVE-2013-4002 | xercesimpl@2.11.0 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2024-24549 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-24122 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2018-8014 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-12086 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36179 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-8034 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1336 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-7489 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2021-21295 | netty@3.5.7.Final | 5.9 | NA | Yes | Library Unused | +| CVE-2020-9548 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-9547 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-25649 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-25122 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1304 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2012-0881 | xercesimpl@2.11.0 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2019-8331 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2018-1305 | tomcat-embed-core@8.5.15 | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2024-21733 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2018-14718 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-20445 | netty@3.5.7.Final | 9.1 | NA | Yes | Library Unused | +| CVE-2020-35728 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2021-36090 | commons-compress@1.9 | 7.5 | NA | Yes | Library Unused | +| CVE-2022-25647 | gson@2.8.0 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-35516 | commons-compress@1.9 | 7.5 | NA | Yes | Library Unused | +| CVE-2021-35515 | commons-compress@1.9 | 7.5 | NA | Yes | Library Unused | +| CVE-2022-23437 | xercesimpl@2.11.0 | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-14540 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-19361 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-19360 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-19362 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36188 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2019-14439 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-17563 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-35517 | commons-compress@1.9 | 7.5 | NA | Yes | Library Unused | +| CVE-2019-12814 | jackson-databind@2.8.8 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2018-8037 | tomcat-embed-core@8.5.15 | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2018-14721 | jackson-databind@2.8.8 | 10.0 | NA | Yes | CVE Not Used 288d | +| CVE-2018-14719 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36184 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2021-29425 | commons-io@2.4 | 4.8 | NA | No | Library Unused | +| CVE-2019-20330 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-20444 | netty@3.5.7.Final | 9.1 | NA | Yes | Library Unused | +| CVE-2020-35491 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-24616 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-12023 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-15756 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-25329 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2020-13956 | httpclient@4.5.3 | 5.3 | NA | Yes | Library Unused | +| CVE-2018-14720 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-15095 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-14379 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-5929 | logback-core@1.1.11 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-5929 | logback-classic@1.1.11 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-10673 | jackson-databind@2.8.8 | 8.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-35490 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2019-16869 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | +| CVE-2020-10683 | dom4j@1.6.1 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2021-20190 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-5968 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-24750 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2018-12022 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1000632 | dom4j@1.6.1 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-37137 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | +| CVE-2018-11307 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-14892 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-16942 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2017-1000487 | plexus-utils@3.0.8 | 9.8 | NA | Yes | Library Unused | +| CVE-2021-37136 | netty@3.5.7.Final | 7.5 | NA | Yes | Library Unused | +| CVE-2022-22968 | spring-context@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2019-16335 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-16943 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-17267 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2019-17531 | jackson-databind@2.8.8 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36182 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36180 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36186 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36181 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36185 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36187 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36189 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-36183 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2020-5529 | htmlunit@2.21 | 8.1 | NA | Yes | Library Unused | +| CVE-2020-36518 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2024-34750 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2021-21409 | netty@3.5.7.Final | 5.9 | NA | Yes | Library Unused | +| CVE-2018-11771 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | +| CVE-2018-1259 | spring-data-commons@1.13.4.RELEASE | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2015-2156 | netty@3.5.7.Final | 0.0 | NA | Yes | Library Unused | +| CVE-2022-41853 | hsqldb@2.3.5 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2025-31651 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2018-3258 | mysql-connector-java@5.1.42 | 8.8 | NA | Yes | CVE Not Used 288d | +| CVE-2024-22243 | spring-web@4.3.9.RELEASE | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2021-42550 | logback-core@1.1.11 | 6.6 | NA | Yes | CVE Not Used 288d | +| CVE-2018-14042 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2018-14040 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2016-10735 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2018-20677 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2018-20676 | bootstrap@3.3.6 | 6.1 | NA | Yes | Library Unused | +| CVE-2023-26119 | htmlunit@2.21 | 9.8 | NA | Yes | Library Unused | +| CVE-2020-10650 | jackson-databind@2.8.8 | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2024-22259 | spring-web@4.3.9.RELEASE | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2022-42004 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-42003 | jackson-databind@2.8.8 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-25857 | snakeyaml@1.17 | 7.5 | NA | Yes | Library Unused | +| CVE-2023-46589 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-49125 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1272 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-11040 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2020-25638 | hibernate-core@5.0.4.Final | 7.4 | NA | Yes | CVE Not Used 288d | +| CVE-2025-46701 | tomcat-embed-core@8.5.15 | 7.3 | NA | Yes | CVE Not Used 288d | +| CVE-2022-38752 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | +| CVE-2021-43797 | netty@3.5.7.Final | 6.5 | NA | Yes | Library Unused | +| CVE-2018-1257 | spring-core@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2018-11039 | spring-web@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1199 | spring-core@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1274 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-52434 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-42252 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-53506 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-52520 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-28366 | neko-htmlunit@2.21 | 7.5 | NA | No | Library Unused | +| CVE-2022-38749 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | +| CVE-2022-38751 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | +| CVE-2019-14900 | hibernate-core@5.0.4.Final | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2024-23672 | tomcat-embed-websocket@8.5.15 | 6.3 | NA | Yes | CVE Not Used 288d | +| CVE-2021-21290 | netty@3.5.7.Final | 5.5 | NA | Yes | Library Unused | +| CVE-2020-15250 | junit@4.12 | 5.5 | NA | Yes | Library Unused | +| CVE-2022-22970 | spring-beans@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2023-42795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2025-48924 | commons-lang@2.6 | 5.3 | NA | Yes | Library Unused | +| CVE-2025-48924 | commons-lang3@3.1 | 5.3 | NA | Yes | Library Unused | +| CVE-2026-43512 | tomcat-embed-core@8.5.15 | 9.8 | NA | Yes | CVE Not Used 288d | +| CVE-2026-43515 | tomcat-embed-core@8.5.15 | 9.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-2332 | jetty-http@9.4.5.v20170502 | 9.1 | NA | Yes | Library Unused | +| CVE-2026-40477 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-40478 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-67030 | plexus-utils@3.0.8 | 8.8 | NA | Yes | Library Unused | +| CVE-2023-22102 | mysql-connector-java@5.1.42 | 8.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-22262 | spring-web@4.3.9.RELEASE | 8.1 | NA | Yes | CVE Not Used 288d | +| CVE-2022-27772 | spring-boot@1.5.4.RELEASE | 7.8 | NA | Yes | CVE Not Used 288d | +| CVE-2023-6378 | logback-core@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2023-6378 | logback-classic@1.1.11 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41284 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2022-4244 | plexus-utils@3.0.8 | 7.5 | NA | Yes | Library Unused | +| CVE-2022-29546 | neko-htmlunit@2.21 | 7.5 | NA | Yes | Library Unused | +| CVE-2023-20883 | spring-boot-autoconfigure@1.5.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-12418 | tomcat-embed-core@8.5.15 | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2022-41854 | snakeyaml@1.17 | 6.5 | NA | Yes | Library Unused | +| CVE-2023-20863 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2023-20861 | spring-expression@4.3.9.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2023-34055 | spring-boot-actuator@1.5.4.RELEASE | 6.5 | NA | Yes | CVE Not Used 288d | +| CVE-2019-2692 | mysql-connector-java@5.1.42 | 6.3 | NA | Yes | CVE Not Used 288d | +| CVE-2018-1196 | spring-boot@1.5.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2022-38750 | snakeyaml@1.17 | 5.5 | NA | Yes | Library Unused | +| CVE-2024-38820 | spring-web@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-38809 | spring-web@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2025-61795 | tomcat-embed-core@8.5.15 | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-6763 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Yes | Library Unused | +| CVE-2023-40167 | jetty-http@9.4.5.v20170502 | 5.3 | NA | Yes | Library Unused | +| CVE-2020-14338 | xercesimpl@2.11.0 | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2019-3797 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2019-3802 | spring-data-jpa@1.11.4.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-38820 | spring-context@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2022-4245 | plexus-utils@3.0.8 | 4.3 | NA | Yes | Library Unused | +| CVE-2021-22096 | spring-core@4.3.9.RELEASE | 4.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-38808 | spring-expression@4.3.9.RELEASE | 4.3 | NA | Yes | CVE Not Used 288d | +| CVE-2024-47554 | commons-io@2.4 | 4.3 | NA | Yes | Library Unused | +| CVE-2020-8908 | guava@19.0 | 3.3 | NA | Yes | CVE Not Used 288d | +| CVE-2022-2047 | jetty-http@9.4.5.v20170502 | 2.7 | NA | Yes | Library Unused | +| CVE-2022-21363 | mysql-connector-java@5.1.42 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-52999 | jackson-core@2.8.8 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41901 | thymeleaf@3.0.6.RELEASE | 9.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-22733 | spring-boot-starter-actuator@1.5.4.RELEASE | 8.1 | NA | Yes | Library Unused | +| CVE-2026-41716 | spring-data-commons@1.13.4.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41842 | spring-webmvc@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-43513 | tomcat-embed-core@8.5.15 | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41848 | spring-core@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41850 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41851 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41849 | spring-expression@4.3.9.RELEASE | 7.5 | NA | Yes | CVE Not Used 288d | +| CVE-2025-22235 | spring-boot@1.5.4.RELEASE | 7.3 | NA | Yes | CVE Not Used 288d | +| CVE-2023-2976 | guava@19.0 | 7.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-40973 | spring-boot@1.5.4.RELEASE | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2017-7536 | hibernate-validator@5.3.5.Final | 7.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-11143 | jetty-http@9.4.5.v20170502 | 6.5 | NA | Yes | Library Unused | +| CVE-2026-41845 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41846 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41844 | spring-webmvc@4.3.9.RELEASE | 6.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41721 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41711 | spring-data-commons@1.13.4.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41841 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41843 | spring-webmvc@4.3.9.RELEASE | 5.9 | NA | Yes | CVE Not Used 288d | +| CVE-2024-25710 | commons-compress@1.9 | 5.5 | NA | Yes | Library Unused | +| CVE-2026-22745 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41853 | spring-webmvc@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2026-41852 | spring-expression@4.3.9.RELEASE | 5.3 | NA | Yes | CVE Not Used 288d | +| CVE-2025-49128 | jackson-core@2.8.8 | 4.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-22741 | spring-webmvc@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | +| CVE-2025-22233 | spring-context@4.3.9.RELEASE | 3.1 | NA | Yes | CVE Not Used 288d | +| CVE-2026-10532 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-1225 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2026-9828 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2025-11226 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2024-12798 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | +| CVE-2024-12801 | logback-core@1.1.11 | 0.0 | NA | Yes | CVE Not Used 288d | + +--- + +## Appendix: Methodology + +VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and per-environment CVE Shield status - see `vex --help` for the exact decision policy. This advisor does not change any claim; it only assesses whether relying on each claim as generated is reasonable given the CVE's severity and exploitability - it doesn't offer a distinct action per claim, since the real options (verify reachability, upgrade the library) are the same regardless of severity. See the Legend above for how the VEX/Rationale columns are derived, and the Key Findings above for which specific CVEs are CISA KEV-listed or high-EPSS. + +- **sound**: the claim's justification (structural fact or active control, or a duration comfortably past the threshold on a low-stakes CVE) supports relying on it as-is +- **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or is otherwise borderline - a human should confirm before treating it as resolved + +--- + +*Report generated by Contrast VEX Advisor* +*Powered by Contrast Security Runtime Observability* diff --git a/samples/sample-vex.json b/samples/sample-vex.json new file mode 100644 index 0000000..32e44b5 --- /dev/null +++ b/samples/sample-vex.json @@ -0,0 +1,26738 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "version": 1, + "metadata": { + "timestamp": "2026-09-03T04:21:00Z", + "component": { + "type": "application", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", + "name": "SAML-PetClinic-Demo", + "properties": [ + { + "name": "contrast:assessEnabledDev", + "value": "true" + }, + { + "name": "contrast:assessEnabledQa", + "value": "" + }, + { + "name": "contrast:assessEnabledProd", + "value": "true" + }, + { + "name": "contrast:adrEnabledDev", + "value": "false" + }, + { + "name": "contrast:adrEnabledQa", + "value": "" + }, + { + "name": "contrast:adrEnabledProd", + "value": "true" + } + ] + } + }, + "components": [ + { + "type": "application", + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2", + "name": "SAML-PetClinic-Demo", + "properties": [ + { + "name": "contrast:assessEnabledDev", + "value": "true" + }, + { + "name": "contrast:assessEnabledQa", + "value": "" + }, + { + "name": "contrast:assessEnabledProd", + "value": "true" + }, + { + "name": "contrast:adrEnabledDev", + "value": "false" + }, + { + "name": "contrast:adrEnabledQa", + "value": "" + }, + { + "name": "contrast:adrEnabledProd", + "value": "true" + } + ] + } + ], + "vulnerabilities": [ + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14721-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-14721", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14721" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14721" + }, + "score": 10.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-14721. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.1" + }, + { + "name": "contrast:epssPercentile", + "value": "95.42" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11307-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-11307", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11307" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11307" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-11307. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-17485-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2017-17485", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2017-17485. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.5" + }, + { + "name": "contrast:epssPercentile", + "value": "98.81" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity, EPSS 0.5 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-8840-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-8840", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-8840. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.27" + }, + { + "name": "contrast:epssPercentile", + "value": "97.87" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16335-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-16335", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16335" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16335" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-16335. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.58" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20330-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-20330", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20330" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20330" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-20330. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14718-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-14718", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14718" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14718" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-14718. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.13" + }, + { + "name": "contrast:epssPercentile", + "value": "95.98" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14720-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-14720", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14720" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14720" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-14720. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14719-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-14719", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14719" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14719" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-14719. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.1" + }, + { + "name": "contrast:epssPercentile", + "value": "95.16" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9548-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-9548", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-9548. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.18" + }, + { + "name": "contrast:epssPercentile", + "value": "97.02" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14540-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-14540", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14540" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14540" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-14540. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9547-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-9547", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-9547. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.18" + }, + { + "name": "contrast:epssPercentile", + "value": "97.03" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14892-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-14892", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14892" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14892" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-14892. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.41" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16942-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-16942", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16942" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16942" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-16942. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-19361-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-19361", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-19361. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16943-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-16943", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16943" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16943" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-16943. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.49" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-19360-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-19360", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-19360. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-19362-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-19362", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-19362. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-17267-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-17267", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17267" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17267" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-17267. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-7525-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2017-7525", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2017-7525. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.38" + }, + { + "name": "contrast:epssPercentile", + "value": "98.44" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-7489-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-7489", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-7489. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.2" + }, + { + "name": "contrast:epssPercentile", + "value": "97.22" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-17531-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-17531", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17531" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17531" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-17531. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "92.1" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-15095-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2017-15095", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously. \\", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2017-15095. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.56" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14379-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-14379", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14379" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14379" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-14379. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.43" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10673-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-10673", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10673" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10673" + }, + "score": 8.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-10673. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.37" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-35728-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-35728", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35728" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35728" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-35728. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.13" + }, + { + "name": "contrast:epssPercentile", + "value": "95.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-35491-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-35491", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35491" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35491" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-35491. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "95.08" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-35490-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-35490", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35490" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35490" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-35490. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.18" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36184-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36184", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36184" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36184" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36184. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.1" + }, + { + "name": "contrast:epssPercentile", + "value": "95.4" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36182-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36182", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36182" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36182" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36182. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.66" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36180-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36180", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36180" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36180" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36180. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.7" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36186-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36186", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36186" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36186" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36186. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36181-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36181", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36181" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36181" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36181. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.66" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36179-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36179", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36179" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36179" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36179. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.21" + }, + { + "name": "contrast:epssPercentile", + "value": "97.39" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10650-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-10650", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10650" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10650" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-10650. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "87.77" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36185-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36185", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36185" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36185" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36185. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36188-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36188", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36188" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36188" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36188. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.56" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36187-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36187", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36187" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36187" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36187. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.9" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36189-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36189", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36189" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36189" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36189. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.5" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36183-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36183", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36183" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36183" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36183. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-20190-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2021-20190", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20190" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20190" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2021-20190. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "94.05" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-5968-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-5968", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5968" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5968" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-5968. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-24616-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-24616", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24616" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24616" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-24616. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "95.06" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-24750-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-24750", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24750" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24750" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-24750. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-42004-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2022-42004", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2022-42004. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.29" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-42003-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2022-42003", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2022-42003. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.29" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-25649-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-25649", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25649" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-25649. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.18" + }, + { + "name": "contrast:epssPercentile", + "value": "96.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-12023-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-12023", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12023" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12023" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-12023. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.88" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-36518-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2020-36518", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36518" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36518" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2020-36518. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.43" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14439-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-14439", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14439" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14439" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-14439. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.54" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-12022-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2018-12022", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12022" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12022" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2018-12022. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12086-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-12086", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-12086. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.22" + }, + { + "name": "contrast:epssPercentile", + "value": "97.49" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12384-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-12384", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12384" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12384" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-12384. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.45" + }, + { + "name": "contrast:epssPercentile", + "value": "98.7" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12814-bf88c7b27e95cbadce4e7c316a56c3efffda8026", + "id": "CVE-2019-12814", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.", + "recommendation": "Upgrade jackson-databind from 2.8.8 to 2.21.5 to remediate CVE-2019-12814. Latest available release is 2.22.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (263 of 582 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.21.5", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "263" + }, + { + "name": "contrast:classCount", + "value": "582" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.56" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-26119-3e752dae0006ad516bf6f4138316db7b262912d0", + "id": "CVE-2023-26119", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26119" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26119" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.", + "recommendation": "Upgrade htmlunit from 2.21 to 2.70.0 to remediate CVE-2023-26119.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 1295 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21", + "versions": [ + { + "version": "2.21", + "status": "affected" + }, + { + "version": "2.70.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "1295" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "83.68" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.70.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-5529-3e752dae0006ad516bf6f4138316db7b262912d0", + "id": "CVE-2020-5529", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5529" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5529" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.", + "recommendation": "Upgrade htmlunit from 2.21 to 2.70.0 to remediate CVE-2020-5529.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 1295 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.21", + "versions": [ + { + "version": "2.21", + "status": "affected" + }, + { + "version": "2.70.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "1295" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.2" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.70.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-10683-5d3ccc056b6f056dbf0dddfdf43894b9065a8f94", + "id": "CVE-2020-10683", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10683" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10683" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.", + "recommendation": "Upgrade dom4j from 1.6.1 to 20040902.021138 to remediate CVE-2020-10683.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (1 of 190 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/dom4j/dom4j@1.6.1", + "versions": [ + { + "version": "1.6.1", + "status": "affected" + }, + { + "version": "20040902.021138", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "1" + }, + { + "name": "contrast:classCount", + "value": "190" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.91" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "20040902.021138" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1000632-5d3ccc056b6f056dbf0dddfdf43894b9065a8f94", + "id": "CVE-2018-1000632", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000632" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.", + "recommendation": "Upgrade dom4j from 1.6.1 to 20040902.021138 to remediate CVE-2018-1000632.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (1 of 190 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/dom4j/dom4j@1.6.1", + "versions": [ + { + "version": "1.6.1", + "status": "affected" + }, + { + "version": "20040902.021138", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "1" + }, + { + "name": "contrast:classCount", + "value": "190" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.35" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "20040902.021138" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-1471-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-1471", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "SnakeYaml\u0027s Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml\u0027s SafeConsturctor when parsing untrusted content to restrict deserialization.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-1471. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-25857-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-25857", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-25857. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.19" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-18640-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2017-18640", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18640" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18640" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2017-18640. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.27" + }, + { + "name": "contrast:epssPercentile", + "value": "97.88" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-38749-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-38749", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-38749. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "80.02" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-41854-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-41854", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41854" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41854" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-41854. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "72.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-38751-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-38751", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-38751. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "78.16" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-38752-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-38752", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38752" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38752" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-38752. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "83.78" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-38750-7a27ea250c5130b2922b86dea63cbb1cc10a660c", + "id": "CVE-2022-38750", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.", + "recommendation": "Upgrade snakeyaml from 1.17 to 2.0 to remediate CVE-2022-38750. Latest available release is 2.5.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 206 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.yaml/snakeyaml@1.17", + "versions": [ + { + "version": "1.17", + "status": "affected" + }, + { + "version": "2.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "206" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.42" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22965-005d6c554f34b20dffcbdfc7edf9b80956e2dace", + "id": "CVE-2022-22965", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.", + "recommendation": "Upgrade spring-boot-starter-web from 1.5.4.RELEASE to 2.5.12 to remediate CVE-2022-22965. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-web@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "2.5.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.95" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1273-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2018-1273", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1273" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1273" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data\u0027s projection-based request payload binding hat can lead to a remote code execution attack.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2018-1273. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.97" + }, + { + "name": "contrast:epssPercentile", + "value": "99.89" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity, CISA KEV-listed, EPSS 0.97 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1274-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2018-1274", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1274" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1274" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2018-1274. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "78.7" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41716-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2026-41716", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41716" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41716" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Data\u0027s internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2026-41716. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.32" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41721-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2026-41721", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41721" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41721" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.\n\nAffected versions:\nSpring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2026-41721. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "25.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41711-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2026-41711", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41711" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41711" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.\n\nAffected versions:\nSpring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2026-41711. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "22.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1259-1a45b99bd63449ba31963237993d4a45b9f96abc", + "id": "CVE-2018-1259", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1259" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1259" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data\u0027s projection-based request payload binding to access arbitrary files on the system.", + "recommendation": "Upgrade spring-data-commons from 1.13.4.RELEASE to 1.13.12.RELEASE to remediate CVE-2018-1259. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (152 of 554 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-commons@1.13.4.RELEASE", + "versions": [ + { + "version": "1.13.4.RELEASE", + "status": "affected" + }, + { + "version": "1.13.12.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "152" + }, + { + "name": "contrast:classCount", + "value": "554" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-41853-4f97fcbc10fecf6f048c3b65683781d031b9155e", + "id": "CVE-2022-41853", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41853" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41853" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property \"hsqldb.method_class_names\" to classes which are allowed to be called. For example, System.setProperty(\"hsqldb.method_class_names\", \"abc\") or Java argument -Dhsqldb.method_class_names\u003d\"abc\" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.", + "recommendation": "Upgrade hsqldb from 2.3.5 to 2.7.1 to remediate CVE-2022-41853. Latest available release is 2.7.4.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (229 of 601 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.hsqldb/hsqldb@2.3.5", + "versions": [ + { + "version": "2.3.5", + "status": "affected" + }, + { + "version": "2.7.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "229" + }, + { + "name": "contrast:classCount", + "value": "601" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.51" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.7.4" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-5929-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2017-5929", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5929" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5929" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2017-5929. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.06" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-6378-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2023-6378", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6378" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6378" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "A serialization vulnerability in logback receiver component part of \nlogback version 1.4.11 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2023-6378. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "57.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-42550-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2021-42550", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42550" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42550" + }, + "score": 6.6, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2021-42550. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "90.73" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-10532-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2026-10532", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10532" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10532" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.\n\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.33 inclusive.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2026-10532. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "30.0" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-1225-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2026-1225", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1225" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1225" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.\n\n\n\n\nThe instantiation of a potentially malicious Java class requires that said class is present on the user\u0027s class-path. In addition, the attacker must have write access to a \nconfiguration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2026-1225. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "4.55" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-9828-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2026-9828", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9828" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9828" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate objects from\n classes in the java.lang and java.util packages that are not explicitly\n blocked.\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalation has been identified, this issue constitutes a bypass of the \nintended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.32 inclusive.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2026-9828. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-11226-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2025-11226", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11226" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11226" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.\n\n\n\nA successful attack requires the presence of Janino library and Spring Framework to be present on the user\u0027s class path. In addition, the attacker must  have write access to a \nconfiguration file. Alternatively, the attacker could inject a malicious \nenvironment variable pointing to a malicious configuration file. In both \ncases, the attack requires existing privilege.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2025-11226. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "9.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-12798-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2024-12798", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12798" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12798" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core\n upto and including version 1.5.12 in Java applications allows\n attacker to execute arbitrary code by compromising an existing\n logback configuration file or by injecting an environment variable\n before program execution.\n\n\n\n\n\nMalicious logback configuration files can allow the attacker to execute \narbitrary code using the JaninoEventEvaluator extension.\n\n\n\nA successful attack requires the user to have write access to a \nconfiguration file. Alternatively, the attacker could inject a malicious \nenvironment variable pointing to a malicious configuration file. In both \ncases, the attack requires existing privilege.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2024-12798. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "38.03" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-12801-88b8df40340eed549fb07e2613879bf6b006704d", + "id": "CVE-2024-12801", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12801" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12801" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to \nforge requests by compromising logback configuration files in XML.\n\n\n\nThe attacks involves the modification of DOCTYPE declaration in  XML configuration files.", + "recommendation": "Upgrade logback-core from 1.1.11 to 1.5.34 to remediate CVE-2024-12801. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (103 of 374 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-core@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.5.34", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "103" + }, + { + "name": "contrast:classCount", + "value": "374" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "13.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2016-1000027-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2016-1000027", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000027" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000027" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Pivotal Spring Framework 4.1.4 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2016-1000027. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.32" + }, + { + "name": "contrast:epssPercentile", + "value": "98.2" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-22243-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-22243", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22243" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22243" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "description": "Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-22243. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.74" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-22262-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-22262", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22262" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22262" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "description": "Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.\n\n", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-22262. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "65.81" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-22259-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-22259", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22259" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22259" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "description": "Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nThis is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.\n\n", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-22259. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "84.1" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11039-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2018-11039", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11039" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11039" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2018-11039. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.17" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38820-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-38820", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38820" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38820" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-38820. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "47.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38809-91dae64c4280093ad5fb4736a10913c9233479c1", + "id": "CVE-2024-38809", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38809" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38809" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "description": "Applications that parse ETags from \"If-Match\" or \"If-None-Match\" request headers are vulnerable to DoS attack.\n\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nUsers of older, unsupported versions could enforce a size limit on \"If-Match\" and \"If-None-Match\" headers, e.g. through a Filter.", + "recommendation": "Upgrade spring-web from 4.3.9.RELEASE to 6.1.21 to remediate CVE-2024-38809. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (211 of 559 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-web@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.21", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "211" + }, + { + "name": "contrast:classCount", + "value": "559" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "55.77" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22965-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2022-22965", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2022-22965. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.95" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41842-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41842", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41842" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41842" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41842. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "33.0" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38819-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2024-38819", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38819" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38819" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2024-38819. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.55" + }, + { + "name": "contrast:epssPercentile", + "value": "98.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 0.55 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41845-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41845", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41845" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41845" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41845. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "5.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41846-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41846", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41846" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41846" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41846. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "4.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41844-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41844", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41844" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41844" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "A Spring MVC or Spring WebFlux application which configures a mapping for \"/**\" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41844. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "4.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41841-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41841", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41841" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41841" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41841. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "26.61" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41843-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41843", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41843" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41843" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41843. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.85" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22745-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-22745", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22745" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22745" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is serving static resources from the file system\n * the application is running on a Windows platform\n\n\nWhen all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-22745. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "26.86" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41853-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-41853", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41853" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41853" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-41853. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "8.22" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22741-ca80b4a00abc388d8046bf372099f35564371c47", + "id": "CVE-2026-22741", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22741" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22741" + }, + "score": 3.1, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "description": "Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled\n * the application adds support for encoded resources resolution\n * the resource cache must be empty when the attacker has access to the application\n\n\nWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.", + "recommendation": "Upgrade spring-webmvc from 4.3.9.RELEASE to 6.2.18 to remediate CVE-2026-22741. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (166 of 498 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.2.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "166" + }, + { + "name": "contrast:classCount", + "value": "498" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "14.42" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-5929-ccedfbacef4a6515d2983e3f89ed753d5d4fb665", + "id": "CVE-2017-5929", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5929" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5929" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.", + "recommendation": "Upgrade logback-classic from 1.1.11 to 1.4.12 to remediate CVE-2017-5929. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (63 of 178 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-classic@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.4.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "63" + }, + { + "name": "contrast:classCount", + "value": "178" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.06" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-6378-ccedfbacef4a6515d2983e3f89ed753d5d4fb665", + "id": "CVE-2023-6378", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6378" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6378" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "A serialization vulnerability in logback receiver component part of \nlogback version 1.4.11 allows an attacker to mount a Denial-Of-Service \nattack by sending poisoned data.\n\n", + "recommendation": "Upgrade logback-classic from 1.1.11 to 1.4.12 to remediate CVE-2023-6378. Latest available release is 1.5.38.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (63 of 178 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/ch.qos.logback/logback-classic@1.1.11", + "versions": [ + { + "version": "1.1.11", + "status": "affected" + }, + { + "version": "1.4.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "63" + }, + { + "name": "contrast:classCount", + "value": "178" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "57.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.5.38" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22965-daa5abf3779c8cad1a2910e1ea08e4272489d8ae", + "id": "CVE-2022-22965", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.", + "recommendation": "Upgrade spring-beans from 4.3.9.RELEASE to 5.2.22.RELEASE to remediate CVE-2022-22965. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (202 of 408 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.22.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "202" + }, + { + "name": "contrast:classCount", + "value": "408" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.95" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22970-daa5abf3779c8cad1a2910e1ea08e4272489d8ae", + "id": "CVE-2022-22970", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22970" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22970" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.", + "recommendation": "Upgrade spring-beans from 4.3.9.RELEASE to 5.2.22.RELEASE to remediate CVE-2022-22970. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (202 of 408 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-beans@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.22.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "202" + }, + { + "name": "contrast:classCount", + "value": "408" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "78.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8014-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8014", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8014" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8014" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable \u0027supportsCredentials\u0027 for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8014. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.22" + }, + { + "name": "contrast:epssPercentile", + "value": "97.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-24813-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-24813", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Path Equivalence: \u0027file.Name\u0027 (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat\u0027s file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.98, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-24813. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.97" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity, CISA KEV-listed, EPSS 1.0 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43512-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43512", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43512. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "66.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-1938-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-1938", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-1938. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.99" + }, + { + "name": "contrast:epssPercentile", + "value": "99.94" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity, CISA KEV-listed, EPSS 0.99 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-31651-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-31651", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31651" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible \nfor a specially crafted request to bypass some rewrite rules. If those \nrewrite rules effectively enforced security constraints, those \nconstraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-31651. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.92" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-50379-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-50379", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50379" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50379" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-50379. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.44" + }, + { + "name": "contrast:epssPercentile", + "value": "98.67" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43515-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43515", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43515" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43515. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "64.31" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0232-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0232", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange\u0027s blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0232. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 1.0 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-12617-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2017-12617", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12617" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2017-12617. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "99.98" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, CISA KEV-listed, EPSS 1.0 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0199-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0199", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0199. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.73" + }, + { + "name": "contrast:epssPercentile", + "value": "99.41" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 0.73 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8034-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8034", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8034" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8034" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8034. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.21" + }, + { + "name": "contrast:epssPercentile", + "value": "97.43" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-17563-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-17563", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17563" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17563" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-17563. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.49" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-46589-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-46589", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-46589. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "84.59" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-55752-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-55752", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55752" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Relative Path Traversal vulnerability in Apache Tomcat.\n\nThe fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-55752. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.67" + }, + { + "name": "contrast:epssPercentile", + "value": "99.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 0.67 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41284-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-41284", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41284" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-41284. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "55.38" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-10072-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-10072", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-10072. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.73" + }, + { + "name": "contrast:epssPercentile", + "value": "99.41" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 0.73 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-43513-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2026-43513", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43513" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2026-43513. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "38.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-25122", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25122" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25122" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A\u0027s request.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25122. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.18" + }, + { + "name": "contrast:epssPercentile", + "value": "96.99" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-34750-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-34750", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34750" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34750" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-34750. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.02" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-48988-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-48988", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48988" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-48988. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.57" + }, + { + "name": "contrast:epssPercentile", + "value": "99.0" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 0.57 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-49125-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-49125", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49125" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-49125. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "87.57" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52434-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-52434", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52434" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-52434. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "78.35" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-42252-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2022-42252", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42252" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42252" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2022-42252. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "73.24" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-53506-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-53506", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53506" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-53506. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "79.28" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52520-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-52520", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52520" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-52520. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "79.97" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-31650-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-31650", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31650" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31650" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-31650. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.6" + }, + { + "name": "contrast:epssPercentile", + "value": "99.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 0.6 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-24549-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-24549", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-24549. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.23" + }, + { + "name": "contrast:epssPercentile", + "value": "97.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-44487-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-44487", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-44487. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "1.0" + }, + { + "name": "contrast:epssPercentile", + "value": "100.0" + }, + { + "name": "contrast:cisaKev", + "value": "true" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, CISA KEV-listed, EPSS 1.0 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1336-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1336", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1336. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.21" + }, + { + "name": "contrast:epssPercentile", + "value": "97.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-46701-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-46701", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46701" + }, + "score": 7.3, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "description": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat\u0027s GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-46701. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "86.11" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-12418-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-12418", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12418" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-12418. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "66.64" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-25329-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-25329", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25329" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-25329. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "95.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-9484-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2020-9484", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9484" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter\u003d\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2020-9484. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.57" + }, + { + "name": "contrast:epssPercentile", + "value": "98.99" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 0.57 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1305-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1305", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1305" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1305. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.14" + }, + { + "name": "contrast:epssPercentile", + "value": "96.38" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-0221-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2019-0221", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2019-0221. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.46" + }, + { + "name": "contrast:epssPercentile", + "value": "98.71" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-24122-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2021-24122", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24122" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2021-24122. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.23" + }, + { + "name": "contrast:epssPercentile", + "value": "97.58" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-8037-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-8037", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8037" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-8037. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.67" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1304-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-1304", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1304" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-1304. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.17" + }, + { + "name": "contrast:epssPercentile", + "value": "96.86" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-61795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2025-61795", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61795" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Improper Resource Shutdown or Release vulnerability in Apache Tomcat.\n\nIf an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\nUsers are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2025-61795. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "65.15" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-21733-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2024-21733", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21733" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2024-21733. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.14" + }, + { + "name": "contrast:epssPercentile", + "value": "96.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-42795-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2023-42795", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2023-42795. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "80.95" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11784-f197a93ae66212767b004fd93d7a1a8ea62bc3fa", + "id": "CVE-2018-11784", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11784" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "description": "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user requested \u0027/foo\u0027) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", + "recommendation": "Upgrade tomcat-embed-core from 8.5.15 to 9.0.118 to remediate CVE-2018-11784. Latest available release is 10.1.57.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (387 of 1481 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "9.0.118", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "387" + }, + { + "name": "contrast:classCount", + "value": "1481" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.94" + }, + { + "name": "contrast:epssPercentile", + "value": "99.85" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: EPSS 0.94 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-1000487-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2017-1000487", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000487" + }, + "score": 9.8, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2017-1000487. Latest available release is 3.6.1.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "versions": [ + { + "version": "3.0.8", + "status": "affected" + }, + { + "version": "4.0.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "102" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "93.28" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.0.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-67030-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2025-67030", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" + }, + "score": 8.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2025-67030. Latest available release is 3.6.1.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "versions": [ + { + "version": "3.0.8", + "status": "affected" + }, + { + "version": "4.0.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "102" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "49.29" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.0.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4244-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2022-4244", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4244" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4244. Latest available release is 3.6.1.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "versions": [ + { + "version": "3.0.8", + "status": "affected" + }, + { + "version": "4.0.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "102" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "69.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.0.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-4245-faba5d28a07fcde50c8c26d3f002774acf11843e", + "id": "CVE-2022-4245", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4245" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --\u003e sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.", + "recommendation": "Upgrade plexus-utils from 3.0.8 to 4.0.3 to remediate CVE-2022-4245. Latest available release is 3.6.1.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 102 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.8", + "versions": [ + { + "version": "3.0.8", + "status": "affected" + }, + { + "version": "4.0.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "102" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "50.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.0.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20445-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-20445", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20445" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20445.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.13" + }, + { + "name": "contrast:epssPercentile", + "value": "96.17" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-20444-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-20444", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20444" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-20444.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.87" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37136-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-37136", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The Bzip2 decompression decoder function doesn\u0027t allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37136.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.72" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-37137-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-37137", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The Snappy frame decoder function doesn\u0027t restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-37137.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.07" + }, + { + "name": "contrast:epssPercentile", + "value": "93.5" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-16869-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2019-16869", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16869" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2019-16869.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.08" + }, + { + "name": "contrast:epssPercentile", + "value": "94.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-43797-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-43797", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to \"sanitize\" header names before it forward these to another remote system when used as proxy. This remote system can\u0027t see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-43797.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "84.8" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21409-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21409", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21409" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21409.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.54" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21295-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21295", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21295" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel\u0027s pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21295.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.19" + }, + { + "name": "contrast:epssPercentile", + "value": "97.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-21290-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2021-21290", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21290" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers \u0026 clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty\u0027s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method \"File.createTempFile\" on unix-like systems creates a random file, but, by default will create this file with the permissions \"-rw-r--r--\". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty\u0027s \"AbstractDiskHttpData\" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own \"java.io.tmpdir\" when you start the JVM or use \"DefaultHttpDataFactory.setBaseDir(...)\" to set the directory to something that is only readable by the current user.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2021-21290.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "76.68" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2015-2156-811465e6dfc89d7c78d21de6a9747b6046cb5403", + "id": "CVE-2015-2156", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2156" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.", + "recommendation": "Upgrade netty from 3.5.7.Final to 3.10.6.Final to remediate CVE-2015-2156.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 727 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/io.netty/netty@3.5.7.Final", + "versions": [ + { + "version": "3.5.7.Final", + "status": "affected" + }, + { + "version": "3.10.6.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "727" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.10.6.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-2332-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2026-2332", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332" + }, + "score": 9.1, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n * https://w4ke.info/2025/06/18/funky-chunks.html\n\n * https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext\u003d\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2026-2332. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "68.57" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-11143-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2025-11143", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2025-11143. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "5.32" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-6763-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2024-6763", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2024-6763. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "59.31" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-40167-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2023-40167", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40167" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2023-40167. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "62.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-2047-c51b8a6a67d64672889249dd958edd77bff8fc0c", + "id": "CVE-2022-2047", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2047" + }, + "score": 2.7, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.", + "recommendation": "Upgrade jetty-http from 9.4.5.v20170502 to 12.1.7 to remediate CVE-2022-2047. Latest available release is 12.0.34.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 81 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.5.v20170502", + "versions": [ + { + "version": "9.4.5.v20170502", + "status": "affected" + }, + { + "version": "12.1.7", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "81" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.39" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "12.1.11" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41901-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-41901", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41901" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-41901.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "35.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40477-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-40477", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40477" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40477.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "55.73" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40478-5101df9798ac08865717dd0bf6860504cd3bd758", + "id": "CVE-2026-40478", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40478" + }, + "score": 9.0, + "severity": "critical", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "description": "Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library\u0027s protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.", + "recommendation": "Upgrade thymeleaf from 3.0.6.RELEASE to 3.1.3.RELEASE to remediate CVE-2026-40478.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (367 of 549 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.thymeleaf/thymeleaf@3.0.6.RELEASE", + "versions": [ + { + "version": "3.0.6.RELEASE", + "status": "affected" + }, + { + "version": "3.1.3.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "367" + }, + { + "name": "contrast:classCount", + "value": "549" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "56.16" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.1.3.RELEASE" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: CRITICAL severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-3258-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2018-3258", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3258" + }, + "score": 8.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2018-3258.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-22102-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2023-22102", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22102" + }, + "score": 8.3, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2023-22102.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "56.43" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-2692-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2019-2692", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2692" + }, + "score": 6.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + ], + "description": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2019-2692.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "40.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-21363-80a448a3ec2178b649bb2e3cb3610fab06e11669", + "id": "CVE-2022-21363", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21363" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).", + "recommendation": "Upgrade mysql-connector-java from 5.1.42 to 8.0.33 to remediate CVE-2022-21363.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (4 of 347 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/mysql/mysql-connector-java@5.1.42", + "versions": [ + { + "version": "5.1.42", + "status": "affected" + }, + { + "version": "8.0.33", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "4" + }, + { + "name": "contrast:classCount", + "value": "347" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "68.89" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.33" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-22733-10f526d22f58a32a8c3af26ccb0a6f16f4649935", + "id": "CVE-2026-22733", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22733" + }, + "score": 8.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Spring Boot applications with Actuator can be vulnerable to an \"Authentication Bypass\" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.", + "recommendation": "Upgrade spring-boot-starter-actuator from 1.5.4.RELEASE to 3.5.12 to remediate CVE-2026-22733. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.5.12", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "28.97" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-27772-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2022-27772", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27772" + }, + "score": 7.8, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "** UNSUPPORTED WHEN ASSIGNED ** spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2022-27772. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.0.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "183" + }, + { + "name": "contrast:classCount", + "value": "458" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "46.27" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-22235-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2025-22235", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22235" + }, + "score": 7.3, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "description": "EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.\n\nYour application may be affected by this if all the following conditions are met:\n\n * You use Spring Security\n * EndpointRequest.to() has been used in a Spring Security chain configuration\n * The endpoint which EndpointRequest references is disabled or not exposed via web\n * Your application handles requests to /null and this path needs protection\n\n\nYou are not affected if any of the following is true:\n\n * You don\u0027t use Spring Security\n * You don\u0027t use EndpointRequest.to()\n * The endpoint which EndpointRequest.to() refers to is enabled and is exposed\n * Your application does not handle requests to /null or this path does not need protection", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2025-22235. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.0.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "183" + }, + { + "name": "contrast:classCount", + "value": "458" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "34.63" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-40973-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2026-40973", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40973" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application\u0027s user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2026-40973. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.0.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "183" + }, + { + "name": "contrast:classCount", + "value": "458" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "3.32" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1196-0cf51bb0751c1362a417eb59824d27d2907780d2", + "id": "CVE-2018-1196", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1196" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the \"run_user\" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the \"run_user\" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.", + "recommendation": "Upgrade spring-boot from 1.5.4.RELEASE to 3.0.0 to remediate CVE-2018-1196. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (183 of 458 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "3.0.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "183" + }, + { + "name": "contrast:classCount", + "value": "458" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "66.4" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-28366-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", + "id": "CVE-2022-28366", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28366" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.", + "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-28366. Latest available release is 2.70.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", + "versions": [ + { + "version": "2.21", + "status": "affected" + }, + { + "version": "2.61.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "53" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "80.88" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.70.0" + }, + { + "name": "contrast:devStatus", + "value": "NO_SHIELD" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NO_SHIELD" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-29546-0a714aa20a2a6e04ada63805e1a16ad0540aa65e", + "id": "CVE-2022-29546", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29546" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.", + "recommendation": "Upgrade neko-htmlunit from 2.21 to 2.61.0 to remediate CVE-2022-29546. Latest available release is 2.70.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 53 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/net.sourceforge.htmlunit/neko-htmlunit@2.21", + "versions": [ + { + "version": "2.21", + "status": "affected" + }, + { + "version": "2.61.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "53" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.25" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.70.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-25647-c4ba5371a29ac9b2ad6129b1d39ea38750043eff", + "id": "CVE-2022-25647", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25647" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.", + "recommendation": "Upgrade gson from 2.8.0 to 2.8.9 to remediate CVE-2022-25647. Latest available release is 2.12.1.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (36 of 174 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.google.code.gson/gson@2.8.0", + "versions": [ + { + "version": "2.8.0", + "status": "affected" + }, + { + "version": "2.8.9", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "36" + }, + { + "name": "contrast:classCount", + "value": "174" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.12" + }, + { + "name": "contrast:epssPercentile", + "value": "95.89" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.13.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-36090-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-36090", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36090" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 zip package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-36090. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.13" + }, + { + "name": "contrast:epssPercentile", + "value": "96.04" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35516-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35516", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35516" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35516. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.12" + }, + { + "name": "contrast:epssPercentile", + "value": "95.91" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35517-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35517", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35517" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress\u0027 tar package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35517. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.11" + }, + { + "name": "contrast:epssPercentile", + "value": "95.47" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-35515-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2021-35515", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35515" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress\u0027 sevenz package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2021-35515. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.12" + }, + { + "name": "contrast:epssPercentile", + "value": "95.73" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-25710-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2024-25710", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.\n\nUsers are recommended to upgrade to version 1.26.0 which fixes the issue.\n\n", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2024-25710. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "36.91" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11771-cc18955ff1e36d5abd39a14bfe82b19154330a34", + "id": "CVE-2018-11771", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11771" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17\u0027s ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress\u0027 zip package.", + "recommendation": "Upgrade commons-compress from 1.9 to 1.26.0 to remediate CVE-2018-11771. Latest available release is 1.28.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 200 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-compress@1.9", + "versions": [ + { + "version": "1.9", + "status": "affected" + }, + { + "version": "1.26.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "200" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.05" + }, + { + "name": "contrast:epssPercentile", + "value": "91.97" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "1.28.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-34169-d55d3f02a56ec4c25695fe67e1334ff8c2ecea23", + "id": "CVE-2022-34169", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34169" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "description": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.", + "recommendation": "Upgrade xalan from 2.7.2 to 2.7.3 to remediate CVE-2022-34169.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (7 of 1501 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xalan/xalan@2.7.2", + "versions": [ + { + "version": "2.7.2", + "status": "affected" + }, + { + "version": "2.7.3", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "7" + }, + { + "name": "contrast:classCount", + "value": "1501" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.81" + }, + { + "name": "contrast:epssPercentile", + "value": "99.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.7.3" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity, EPSS 0.81 - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1272-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1272", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1272" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1272. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "86.79" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-15756-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-15756", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15756" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-15756. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.98" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41848-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2026-41848", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: match(String pattern, String path), matchStart(String pattern, String path), extractUriTemplateVariables(String pattern, String path).\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2026-41848. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "24.07" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-11040-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-11040", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11040" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the \"jsonp\" and \"callback\" JSONP parameters, enabling cross-domain requests.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-11040. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "87.45" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1257-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1257", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1257. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "87.42" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1271-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1271", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1271" + }, + "score": 5.9, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1271. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.35" + }, + { + "name": "contrast:epssPercentile", + "value": "98.3" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-1199-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2018-1199", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1199" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2018-1199. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "85.69" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-22096-430b7298bfb85d66fb61e19ca8f06231b911e9f5", + "id": "CVE-2021-22096", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22096" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.", + "recommendation": "Upgrade spring-core from 4.3.9.RELEASE to 5.2.19.RELEASE to remediate CVE-2021-22096. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (334 of 791 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-core@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.2.19.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "334" + }, + { + "name": "contrast:classCount", + "value": "791" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "69.88" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41850-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41850", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41850. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "28.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41851-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41851", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41851. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "28.94" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41849-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41849", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41849" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS).\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41849. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "17.87" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20863-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2023-20863", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20863" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20863. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "63.96" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20861-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2023-20861", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20861" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2023-20861. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "59.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22950-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2022-22950", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22950" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2022-22950. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.36" + }, + { + "name": "contrast:epssPercentile", + "value": "98.36" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2026-41852-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2026-41852", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2026-41852. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "7.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38808-4edca6913da9e62a6586714e053e01a61952a153", + "id": "CVE-2024-38808", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "description": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.", + "recommendation": "Upgrade spring-expression from 4.3.9.RELEASE to 5.3.39 to remediate CVE-2024-38808. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (91 of 142 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "5.3.39", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "91" + }, + { + "name": "contrast:classCount", + "value": "142" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "44.84" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-20883-5591fa7358d950f374532c7d92dccf113ebfa1bb", + "id": "CVE-2023-20883", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20883" + }, + "score": 7.5, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.", + "recommendation": "Upgrade spring-boot-autoconfigure from 1.5.4.RELEASE to 2.5.15 to remediate CVE-2023-20883. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (195 of 848 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "2.5.15", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "195" + }, + { + "name": "contrast:classCount", + "value": "848" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "57.6" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-23672-a92b066b0ea9ee1cb05b7d5e4bfed4ad8898f741", + "id": "CVE-2024-23672", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" + }, + "score": 6.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "description": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\n\n", + "recommendation": "Upgrade tomcat-embed-websocket from 8.5.15 to 8.0.32 to remediate CVE-2024-23672. Latest available release is 10.1.4.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (25 of 168 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.15", + "versions": [ + { + "version": "8.5.15", + "status": "affected" + }, + { + "version": "8.0.32", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "25" + }, + { + "name": "contrast:classCount", + "value": "168" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "82.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "11.0.24" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-25638-7e1217f0df943561766b715ffb6cb1d270f3b715", + "id": "CVE-2020-25638", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25638" + }, + "score": 7.4, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.", + "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2020-25638. Latest available release is 5.4.33.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", + "versions": [ + { + "version": "5.0.4.Final", + "status": "affected" + }, + { + "version": "5.5.6", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "1563" + }, + { + "name": "contrast:classCount", + "value": "3787" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.03" + }, + { + "name": "contrast:epssPercentile", + "value": "86.13" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.2.5.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-14900-7e1217f0df943561766b715ffb6cb1d270f3b715", + "id": "CVE-2019-14900", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14900" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "description": "A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.", + "recommendation": "Upgrade hibernate-core from 5.0.4.Final to 5.5.6 to remediate CVE-2019-14900. Latest available release is 5.4.33.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (1563 of 3787 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.hibernate/hibernate-core@5.0.4.Final", + "versions": [ + { + "version": "5.0.4.Final", + "status": "affected" + }, + { + "version": "5.5.6", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "1563" + }, + { + "name": "contrast:classCount", + "value": "3787" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "80.65" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.2.5.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2017-7536-0622a9bcef2eed6d41b5b8e0662c36212009e375", + "id": "CVE-2017-7536", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7536" + }, + "score": 7.0, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "description": "In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager\u0027s reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().", + "recommendation": "Upgrade hibernate-validator from 5.3.5.Final to 8.0.2.Final to remediate CVE-2017-7536.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (225 of 459 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.hibernate/hibernate-validator@5.3.5.Final", + "versions": [ + { + "version": "5.3.5.Final", + "status": "affected" + }, + { + "version": "8.0.2.Final", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "225" + }, + { + "name": "contrast:classCount", + "value": "459" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "39.71" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "8.0.2.Final" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-2976-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", + "id": "CVE-2023-2976", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2976" + }, + "score": 7.1, + "severity": "high", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "description": "Use of Java\u0027s default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.\n\nEven though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.\n\n", + "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2023-2976.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.google.guava/guava@19.0", + "versions": [ + { + "version": "19.0", + "status": "affected" + }, + { + "version": "33.6.0-jre", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "5" + }, + { + "name": "contrast:classCount", + "value": "1717" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "15.93" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "33.6.0-jre" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "needs_review" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "Flagged: HIGH severity - duration-based claim, not a structural guarantee." + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-8908-6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9", + "id": "CVE-2020-8908", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8908" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8908" + }, + "score": 3.3, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.", + "recommendation": "Upgrade guava from 19.0 to 33.6.0-jre to remediate CVE-2020-8908.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (5 of 1717 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.google.guava/guava@19.0", + "versions": [ + { + "version": "19.0", + "status": "affected" + }, + { + "version": "33.6.0-jre", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "5" + }, + { + "name": "contrast:classCount", + "value": "1717" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "59.29" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "33.6.0-jre" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2012-0881-9bb329db1cfc4e22462c9d6b43a8432f5850e92c", + "id": "CVE-2012-0881", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0881" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0881" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.", + "recommendation": "Upgrade xercesimpl from 2.11.0 to 2.12.2 to remediate CVE-2012-0881.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (115 of 952 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xerces/xercesimpl@2.11.0", + "versions": [ + { + "version": "2.11.0", + "status": "affected" + }, + { + "version": "2.12.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "115" + }, + { + "name": "contrast:classCount", + "value": "952" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.17" + }, + { + "name": "contrast:epssPercentile", + "value": "96.85" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.12.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2013-4002-9bb329db1cfc4e22462c9d6b43a8432f5850e92c", + "id": "CVE-2013-4002", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.", + "recommendation": "Upgrade xercesimpl from 2.11.0 to 2.12.2 to remediate CVE-2013-4002.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (115 of 952 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xerces/xercesimpl@2.11.0", + "versions": [ + { + "version": "2.11.0", + "status": "affected" + }, + { + "version": "2.12.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "115" + }, + { + "name": "contrast:classCount", + "value": "952" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.25" + }, + { + "name": "contrast:epssPercentile", + "value": "97.74" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.12.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-23437-9bb329db1cfc4e22462c9d6b43a8432f5850e92c", + "id": "CVE-2022-23437", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "description": "There\u0027s a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.", + "recommendation": "Upgrade xercesimpl from 2.11.0 to 2.12.2 to remediate CVE-2022-23437.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (115 of 952 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xerces/xercesimpl@2.11.0", + "versions": [ + { + "version": "2.11.0", + "status": "affected" + }, + { + "version": "2.12.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "115" + }, + { + "name": "contrast:classCount", + "value": "952" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.12" + }, + { + "name": "contrast:epssPercentile", + "value": "95.74" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.12.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-14338-9bb329db1cfc4e22462c9d6b43a8432f5850e92c", + "id": "CVE-2020-14338", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14338" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14338" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "A flaw was found in Wildfly\u0027s implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the \"use-grammar-pool-only\" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.", + "recommendation": "Upgrade xercesimpl from 2.11.0 to 2.12.2 to remediate CVE-2020-14338.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (115 of 952 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/xerces/xercesimpl@2.11.0", + "versions": [ + { + "version": "2.11.0", + "status": "affected" + }, + { + "version": "2.12.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "115" + }, + { + "name": "contrast:classCount", + "value": "952" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "68.28" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.12.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2023-34055-6fed8833ba044e22a2924f8fe70db4f126be7489", + "id": "CVE-2023-34055", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34055" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34055" + }, + "score": 6.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "description": "In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n * the application uses Spring MVC or Spring WebFlux\n * org.springframework.boot:spring-boot-actuator is on the classpath\n\n\n\n", + "recommendation": "Upgrade spring-boot-actuator from 1.5.4.RELEASE to 2.7.18 to remediate CVE-2023-34055. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (161 of 435 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.boot/spring-boot-actuator@1.5.4.RELEASE", + "versions": [ + { + "version": "1.5.4.RELEASE", + "status": "affected" + }, + { + "version": "2.7.18", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "161" + }, + { + "name": "contrast:classCount", + "value": "435" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "66.57" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14042-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2018-14042", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2018-14042. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.84" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-14040-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2018-14040", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2018-14040. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "90.13" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2016-10735-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2016-10735", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2016-10735. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.91" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-8331-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2019-8331", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2019-8331. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.16" + }, + { + "name": "contrast:epssPercentile", + "value": "96.75" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-20677-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2018-20677", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20677" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20677" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2018-20677. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.78" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2018-20676-1360e2bcd3016ce44a273d2a3b6569963bb0bd68", + "id": "CVE-2018-20676", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20676" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20676" + }, + "score": 6.1, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "description": "In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.", + "recommendation": "Upgrade bootstrap from 3.3.6 to 3.4.1 to remediate CVE-2018-20676. Latest available release is 5.2.3.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 0 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.webjars/bootstrap@3.3.6", + "versions": [ + { + "version": "3.3.6", + "status": "affected" + }, + { + "version": "3.4.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "0" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.04" + }, + { + "name": "contrast:epssPercentile", + "value": "89.37" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "5.3.7" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-15250-2973d150c0dc1fefe998f834810d68f278ea58ec", + "id": "CVE-2020-15250", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15250" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15250" + }, + "score": 5.5, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + } + ], + "description": "In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system\u0027s temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.", + "recommendation": "Upgrade junit from 4.12 to 4.13.2 to remediate CVE-2020-15250.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 286 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/junit/junit@4.12", + "versions": [ + { + "version": "4.12", + "status": "affected" + }, + { + "version": "4.13.2", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "286" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "75.52" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.13.2" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-48924-0ce1edb914c94ebc388f086c6827e8bdeec71ac2", + "id": "CVE-2025-48924", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "description": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.", + "recommendation": "Upgrade commons-lang from 2.6 to 20030203.000129 to remediate CVE-2025-48924.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 133 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/commons-lang/commons-lang@2.6", + "versions": [ + { + "version": "2.6", + "status": "affected" + }, + { + "version": "20030203.000129", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "133" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "81.86" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.6" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-48924-905075e6c80f206bbe6cf1e809d2caa69f420c76", + "id": "CVE-2025-48924", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "description": "Uncontrolled Recursion vulnerability in Apache Commons Lang.\n\nThis issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.\n\nThe methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a \nStackOverflowError could cause an application to stop.\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue.", + "recommendation": "Upgrade commons-lang3 from 3.1 to 3.20.0 to remediate CVE-2025-48924.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 152 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.commons/commons-lang3@3.1", + "versions": [ + { + "version": "3.1", + "status": "affected" + }, + { + "version": "3.20.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "152" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.02" + }, + { + "name": "contrast:epssPercentile", + "value": "81.86" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "3.20.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-3797-9f559debeb095fb0040102aef37e5fee2830a470", + "id": "CVE-2019-3797", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3797" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3797" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.", + "recommendation": "Upgrade spring-data-jpa from 1.11.4.RELEASE to 1.11.22.RELEASE to remediate CVE-2019-3797. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (62 of 169 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE", + "versions": [ + { + "version": "1.11.4.RELEASE", + "status": "affected" + }, + { + "version": "1.11.22.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "62" + }, + { + "name": "contrast:classCount", + "value": "169" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "63.01" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2019-3802-9f559debeb095fb0040102aef37e5fee2830a470", + "id": "CVE-2019-3802", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3802" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3802" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.", + "recommendation": "Upgrade spring-data-jpa from 1.11.4.RELEASE to 1.11.22.RELEASE to remediate CVE-2019-3802. Latest available release is 4.1.0.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (62 of 169 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework.data/spring-data-jpa@1.11.4.RELEASE", + "versions": [ + { + "version": "1.11.4.RELEASE", + "status": "affected" + }, + { + "version": "1.11.22.RELEASE", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "62" + }, + { + "name": "contrast:classCount", + "value": "169" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.27" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.1.0" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2022-22968-a186823724f03b98becd5f93b1fa107fe6f7a7ff", + "id": "CVE-2022-22968", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22968" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22968" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.", + "recommendation": "Upgrade spring-context from 4.3.9.RELEASE to 6.1.20 to remediate CVE-2022-22968. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (306 of 768 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.20", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "306" + }, + { + "name": "contrast:classCount", + "value": "768" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.06" + }, + { + "name": "contrast:epssPercentile", + "value": "92.45" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-38820-a186823724f03b98becd5f93b1fa107fe6f7a7ff", + "id": "CVE-2024-38820", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38820" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38820" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.", + "recommendation": "Upgrade spring-context from 4.3.9.RELEASE to 6.1.20 to remediate CVE-2024-38820. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (306 of 768 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.20", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "306" + }, + { + "name": "contrast:classCount", + "value": "768" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "47.23" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-22233-a186823724f03b98becd5f93b1fa107fe6f7a7ff", + "id": "CVE-2025-22233", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22233" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22233" + }, + "score": 3.1, + "severity": "low", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.\n\nAffected Spring Products and Versions\n\nSpring Framework:\n * 6.2.0 - 6.2.6\n\n * 6.1.0 - 6.1.19\n\n * 6.0.0 - 6.0.27\n\n * 5.3.0 - 5.3.42\n * Older, unsupported versions are also affected\n\n\n\nMitigation\n\nUsers of affected versions should upgrade to the corresponding fixed version.\n\nAffected version(s)Fix Version Availability 6.2.x\n 6.2.7\nOSS6.1.x\n 6.1.20\nOSS6.0.x\n 6.0.28\n Commercial https://enterprise.spring.io/ 5.3.x\n 5.3.43\n Commercial https://enterprise.spring.io/ \nNo further mitigation steps are necessary.\n\n\nGenerally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.\n\nFor setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.\n\nCredit\n\nThis issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.", + "recommendation": "Upgrade spring-context from 4.3.9.RELEASE to 6.1.20 to remediate CVE-2025-22233. Latest available release is 7.0.8.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (306 of 768 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/org.springframework/spring-context@4.3.9.RELEASE", + "versions": [ + { + "version": "4.3.9.RELEASE", + "status": "affected" + }, + { + "version": "6.1.20", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "306" + }, + { + "name": "contrast:classCount", + "value": "768" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "33.85" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "7.0.8" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2020-13956-d1577ae15f01ef5438c5afc62162457c00a34713", + "id": "CVE-2020-13956", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13956" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13956" + }, + "score": 5.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "description": "Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.", + "recommendation": "Upgrade httpclient from 4.5.3 to 4.5.13 to remediate CVE-2020-13956. Latest available release is 4.5.14.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 466 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/org.apache.httpcomponents/httpclient@4.5.3", + "versions": [ + { + "version": "4.5.3", + "status": "affected" + }, + { + "version": "4.5.13", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "466" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.09" + }, + { + "name": "contrast:epssPercentile", + "value": "94.92" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "4.5.14" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2021-29425-b1b6ea3b7e4aa4f492509a4952029cd8e48019ad", + "id": "CVE-2021-29425", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29425" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29425" + }, + "score": 4.8, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "description": "In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"//../foo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value.", + "recommendation": "Upgrade commons-io from 2.4 to 2.14.0 to remediate CVE-2021-29425. Latest available release is 2.22.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 110 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/commons-io/commons-io@2.4", + "versions": [ + { + "version": "2.4", + "status": "affected" + }, + { + "version": "2.14.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "110" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.1" + }, + { + "name": "contrast:epssPercentile", + "value": "95.34" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "false" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.0" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2024-47554-b1b6ea3b7e4aa4f492509a4952029cd8e48019ad", + "id": "CVE-2024-47554", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" + }, + "score": 4.3, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + } + ], + "description": "Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue.", + "recommendation": "Upgrade commons-io from 2.4 to 2.14.0 to remediate CVE-2024-47554. Latest available release is 2.22.0.", + "analysis": { + "state": "not_affected", + "justification": "code_not_reachable", + "detail": "Library not observed executing at runtime in SAML-PetClinic-Demo - 0 of 110 classes loaded (Contrast runtime library-usage data)." + }, + "affects": [ + { + "ref": "pkg:maven/commons-io/commons-io@2.4", + "versions": [ + { + "version": "2.4", + "status": "affected" + }, + { + "version": "2.14.0", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "0" + }, + { + "name": "contrast:classCount", + "value": "110" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "67.09" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.0" + }, + { + "name": "contrast:devStatus", + "value": "" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-49128-d478fb6de45a7c3d2cad07c8ad70c7f0a797a020", + "id": "CVE-2025-49128", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49128" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49128" + }, + "score": 4.0, + "severity": "medium", + "method": "CVSSv31", + "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "description": "Jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core\u0027s `JsonLocation._appendSourceDesc` method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array instead of the logical payload start. This results in possible information disclosure in systems using pooled or reused buffers, like Netty or Vert.x. This issue was silently fixed in jackson-core version 2.13.0, released on September 30, 2021, via PR #652. All users should upgrade to version 2.13.0 or later. If upgrading is not immediately possible, applications can mitigate the issue by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage.", + "recommendation": "Upgrade jackson-core from 2.8.8 to 2.22.1 to remediate CVE-2025-49128.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (48 of 95 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.22.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "48" + }, + { + "name": "contrast:classCount", + "value": "95" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.0" + }, + { + "name": "contrast:epssPercentile", + "value": "29.58" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + }, + { + "bom-ref": "eddb8263-7ceb-4f56-a227-36065ce2e9c2-cve-2025-52999-d478fb6de45a7c3d2cad07c8ad70c7f0a797a020", + "id": "CVE-2025-52999", + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52999" + }, + "ratings": [ + { + "source": { + "name": "NVD", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52999" + }, + "score": 0.0, + "method": "CVSSv31" + } + ], + "description": "jackson-core contains core low-level incremental (\"streaming\") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.", + "recommendation": "Upgrade jackson-core from 2.8.8 to 2.22.1 to remediate CVE-2025-52999.", + "analysis": { + "state": "not_affected", + "response": [ + "update" + ], + "detail": "Library loaded (48 of 95 classes used) but this CVE\u0027s vulnerable code path has not been observed executing in SAML-PetClinic-Demo (across its own dev/qa/prod environments) in 288 days of runtime monitoring (policy threshold: 30 days). Operational risk acceptance based on runtime observation, not a structural non-reachability guarantee." + }, + "affects": [ + { + "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8", + "versions": [ + { + "version": "2.8.8", + "status": "affected" + }, + { + "version": "2.22.1", + "status": "unaffected" + } + ] + } + ], + "properties": [ + { + "name": "contrast:appId", + "value": "eddb8263-7ceb-4f56-a227-36065ce2e9c2" + }, + { + "name": "contrast:appName", + "value": "SAML-PetClinic-Demo" + }, + { + "name": "contrast:classesUsed", + "value": "48" + }, + { + "name": "contrast:classCount", + "value": "95" + }, + { + "name": "contrast:daysObserved", + "value": "288" + }, + { + "name": "contrast:acceptAfterDays", + "value": "30" + }, + { + "name": "contrast:envFilter", + "value": "ALL" + }, + { + "name": "contrast:epssScore", + "value": "0.01" + }, + { + "name": "contrast:epssPercentile", + "value": "49.36" + }, + { + "name": "contrast:cisaKev", + "value": "false" + }, + { + "name": "contrast:shieldAvailable", + "value": "true" + }, + { + "name": "contrast:latestVersion", + "value": "2.22.1" + }, + { + "name": "contrast:devStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:qaStatus", + "value": "" + }, + { + "name": "contrast:prodStatus", + "value": "NOT_SEEN" + }, + { + "name": "contrast:vexAdvisorAssessment", + "value": "sound" + }, + { + "name": "contrast:vexAdvisorRationale", + "value": "sound" + } + ] + } + ] +} \ No newline at end of file diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/AppGraphInfo.java b/src/main/java/com/contrastsecurity/runtimeanalyst/AppGraphInfo.java index c8e931e..aacab06 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/AppGraphInfo.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/AppGraphInfo.java @@ -1,6 +1,8 @@ package com.contrastsecurity.runtimeanalyst; +import java.util.HashMap; import java.util.HashSet; +import java.util.Map; import java.util.Set; /** @@ -20,4 +22,16 @@ public class AppGraphInfo { public int serverCount; public int libraryCount; public Set connectedApplications = new HashSet<>(); + + /** + * For entries in connectedApplications that are themselves other Contrast applications + * (as opposed to a server/library cluster), maps the connected application's + * contrast-graph display name to its applicationId. The graph's display name for an + * application does not always match that application's "applicationName" as reported by + * the /observations endpoint, so consumers that need to resolve a connection back to an + * application they already know about (e.g. to link a Blueprint flow to an existing asset + * instead of creating a spurious duplicate) should resolve via this map by id first, and + * only fall back to matching on the name string. + */ + public Map connectedApplicationIds = new HashMap<>(); } diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/ApplicationGraphFetcher.java b/src/main/java/com/contrastsecurity/runtimeanalyst/ApplicationGraphFetcher.java index d450541..14b4898 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/ApplicationGraphFetcher.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/ApplicationGraphFetcher.java @@ -142,6 +142,8 @@ public static Map fetch( if (sourceAppId != null && targetAppId != null) { addConnection(result, sourceAppId, appNameFor(nodesByGraphId, target)); addConnection(result, targetAppId, appNameFor(nodesByGraphId, source)); + addConnectionId(result, sourceAppId, appNameFor(nodesByGraphId, target), targetAppId); + addConnectionId(result, targetAppId, appNameFor(nodesByGraphId, source), sourceAppId); continue; } @@ -169,6 +171,13 @@ private static void addConnection(Map result, String appId } } + private static void addConnectionId(Map result, String appId, String connectedName, String connectedAppId) { + AppGraphInfo info = result.get(appId); + if (info != null && connectedName != null && connectedAppId != null) { + info.connectedApplicationIds.put(connectedName, connectedAppId); + } + } + private static void tallyCluster(Map result, String appId, JsonObject clusterNode) { if (clusterNode == null) return; AppGraphInfo info = result.get(appId); diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/BlueprintGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/BlueprintGenerator.java new file mode 100644 index 0000000..1820d35 --- /dev/null +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/BlueprintGenerator.java @@ -0,0 +1,749 @@ +package com.contrastsecurity.runtimeanalyst; + +import java.io.File; +import java.io.FileInputStream; +import java.io.FileWriter; +import java.io.IOException; +import java.io.InputStream; +import java.util.ArrayList; +import java.util.Date; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Properties; +import java.util.Set; +import java.util.UUID; + +import org.apache.http.HttpResponse; +import org.apache.http.client.methods.HttpGet; +import org.apache.http.client.methods.HttpPost; +import org.apache.http.entity.StringEntity; +import org.apache.http.impl.client.CloseableHttpClient; +import org.apache.http.impl.client.HttpClients; +import org.apache.http.util.EntityUtils; + +import com.google.gson.Gson; +import com.google.gson.GsonBuilder; +import com.google.gson.JsonArray; +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * Generates a CycloneDX "Blueprint" (Architectural BOM + Bill of Behaviors) from Contrast + * API data: the contrast-graph architecture/connection graph plus crypto-algorithm and + * ai-usage observations, reclassified as entries from the CycloneDX behavior taxonomy. + * + * Blueprints are not yet part of a ratified CycloneDX release. As of this writing, + * cyclonedx-core-java (and CycloneDX 1.7) have no model classes or schema for them - the + * only draft schema is on the unreleased "2.0-dev" branch of CycloneDX/specification + * (open PR https://github.com/CycloneDX/specification/pull/652, + * schema/2.0/model/cyclonedx-blueprint-2.0.schema.json / + * cyclonedx-behavior-2.0.schema.json / behavior-taxonomy.schema.json). This generator + * hand-builds JSON matching that draft shape via Gson rather than typed model classes, + * and will need to be revisited once the spec (and a library that supports it) lands. + * + * Only the parts of a Blueprint that Contrast's runtime data can actually back are + * populated: assets (from the architecture graph), zones (from deployment tier), flows + * (from architecture graph connections), and behavior instances (from crypto/AI usage + * observations, mapped onto the CycloneDX behavior taxonomy). Threat modeling (TM-BOM) - + * threats, scenarios, controls, risks - is a separate, sibling top-level construct in the + * draft spec and is intentionally out of scope here: none of it can be derived from + * Contrast telemetry without an actual STRIDE-style analysis, so generating it would mean + * fabricating findings rather than reporting observed facts. + * + * Usage: + * java -jar runtime-analyst.jar blueprint # Fetch all apps, output blueprint.json + * java -jar runtime-analyst.jar blueprint --app "AppName" # Fetch single app + * java -jar runtime-analyst.jar blueprint --list # List available applications + * java -jar runtime-analyst.jar blueprint -o custom.json # Custom output filename + * java -jar runtime-analyst.jar blueprint -c config.properties + * + * Config file (contrast.properties): + * contrast.url=https://your-instance.contrastsecurity.com/api/ns-ui/v1 + * contrast.org_id=your-org-id + * contrast.auth_header=base64-encoded-credentials + * contrast.api_key=your-api-key + */ +public class BlueprintGenerator { + + private static final String CRYPTO_ALGORITHM_RULE_ID = "crypto-algorithm"; + private static final String AI_USAGE_RULE_ID = "ai-usage"; + + private String baseUrl; + private String orgId; + private String authHeader; + private String apiKey; + private String envFilter; // PRODUCTION, DEVELOPMENT, QA, etc. + + private final Gson gson = new Gson(); + private final Gson prettyGson = new GsonBuilder().setPrettyPrinting().create(); + + public void setEnvFilter(String env) { + this.envFilter = env; + } + + public BlueprintGenerator(String configFile) throws IOException { + loadConfig(configFile); + } + + private void loadConfig(String configFile) throws IOException { + Properties props = new Properties(); + + File f; + if (configFile != null) { + f = new File(configFile); + if (!f.exists()) { + throw new IOException("Config file not found: " + configFile); + } + } else { + f = new File("contrast.properties"); + if (!f.exists()) { + throw new IOException("No contrast.properties found in current directory.\n" + + "Create one with:\n" + + " contrast.url=https://your-instance.contrastsecurity.com/api/ns-ui/v1\n" + + " contrast.org_id=your-org-id\n" + + " contrast.auth_header=base64-encoded-credentials\n" + + " contrast.api_key=your-api-key\n" + + "Or specify a config file with -c option."); + } + } + + InputStream is = new FileInputStream(f); + try { + props.load(is); + } finally { + is.close(); + } + + baseUrl = props.getProperty("contrast.url"); + orgId = props.getProperty("contrast.org_id"); + authHeader = props.getProperty("contrast.auth_header"); + apiKey = props.getProperty("contrast.api_key"); + + if (baseUrl == null || orgId == null || authHeader == null || apiKey == null) { + throw new IOException("Config file must contain: contrast.url, contrast.org_id, contrast.auth_header, contrast.api_key"); + } + } + + public static void main(String[] args) { + String appFilter = null; + String envFilter = null; + String outputFile = "blueprint.json"; + String configFile = null; + boolean listOnly = false; + + for (int i = 0; i < args.length; i++) { + if ("--app".equals(args[i]) && i + 1 < args.length) { + appFilter = args[++i]; + } else if ("--env".equals(args[i]) && i + 1 < args.length) { + envFilter = args[++i].toUpperCase(); + } else if ("--list".equals(args[i])) { + listOnly = true; + } else if ("-o".equals(args[i]) && i + 1 < args.length) { + outputFile = args[++i]; + } else if ("-c".equals(args[i]) && i + 1 < args.length) { + configFile = args[++i]; + } else if ("--help".equals(args[i]) || "-h".equals(args[i])) { + printUsage(); + System.exit(0); + } + } + + try { + BlueprintGenerator generator = new BlueprintGenerator(configFile); + generator.setEnvFilter(envFilter); + List observations = generator.fetchObservations(); + + if (listOnly) { + generator.listApplications(observations); + } else { + BlueprintResult result = generator.generateBlueprint(observations, appFilter); + + if (appFilter != null && "blueprint.json".equals(outputFile)) { + String nameForFile = result.resolvedAppName != null ? result.resolvedAppName : appFilter; + String safeAppName = nameForFile.replaceAll("[^a-zA-Z0-9-_]", "_"); + outputFile = "blueprint-" + safeAppName + ".json"; + } + + generator.writeBlueprint(result.document, outputFile); + } + } catch (Exception e) { + System.err.println("Error: " + e.getMessage()); + e.printStackTrace(); + System.exit(1); + } + } + + private static void printUsage() { + System.out.println("\nBlueprint Generator - Create a CycloneDX Blueprint (ABOM + Bill of Behaviors) from Contrast data"); + System.out.println("\nUsage:"); + System.out.println(" java -jar runtime-analyst.jar blueprint Generate a Blueprint for all apps"); + System.out.println(" java -jar runtime-analyst.jar blueprint --app Filter by app (ID or name)"); + System.out.println(" java -jar runtime-analyst.jar blueprint --env Filter by environment (PRODUCTION, DEVELOPMENT, QA)"); + System.out.println(" java -jar runtime-analyst.jar blueprint --list List available applications with IDs"); + System.out.println(" java -jar runtime-analyst.jar blueprint -o Specify output filename"); + System.out.println(" java -jar runtime-analyst.jar blueprint -c Use custom config file"); + System.out.println("\nConfig file (contrast.properties):"); + System.out.println(" contrast.url=https://your-instance.contrastsecurity.com/api/ns-ui/v1"); + System.out.println(" contrast.org_id=your-org-id"); + System.out.println(" contrast.auth_header=base64-encoded-credentials"); + System.out.println(" contrast.api_key=your-api-key"); + System.out.println("\nNote: Blueprints are a CycloneDX draft (unreleased 2.0-dev branch, spec PR #652)."); + System.out.println("This command populates assets/zones/flows/behaviors from real Contrast data only -"); + System.out.println("it does not generate threats/controls/risks (TM-BOM), which would require fabricating"); + System.out.println("findings Contrast's telemetry cannot back."); + } + + // Raw counts before dedup, keyed by "crypto:" or "ai:/" + private Map rawCounts = new HashMap<>(); + + // Application-level architecture/connection info from the Contrast graph, keyed by applicationId + private Map appGraphInfo = new HashMap<>(); + + public List fetchObservations() throws IOException { + System.out.println("\nFetching observations from Contrast API..."); + + rawCounts.clear(); + + try (CloseableHttpClient httpClient = HttpClients.createDefault()) { + JsonArray observationList = fetchObservationsList(httpClient); + System.out.println(" Found " + observationList.size() + " total observations"); + + // Dedup key: kind + algorithm/model + applicationId + route (before fetching details) + Map uniqueObservations = new HashMap<>(); + Set environmentsSeen = new HashSet<>(); + int skipped = 0; + int irrelevant = 0; + + for (JsonElement element : observationList) { + JsonObject obs = element.getAsJsonObject(); + + String ruleId = getStringOrNull(obs, "ruleId"); + Observation observation; + if (CRYPTO_ALGORITHM_RULE_ID.equals(ruleId)) { + observation = parseObservationFromList(obs); + observation.kind = "crypto"; + observation.algorithm = getStringOrNull(obs, "attackValue"); + } else if (AI_USAGE_RULE_ID.equals(ruleId)) { + observation = parseObservationFromList(obs); + observation.kind = "ai"; + AIUsageParser parser = new AIUsageParser(getStringOrNull(obs, "attackValue"), getStringOrNull(obs, "summary")); + observation.provider = parser.getProvider(); + observation.model = parser.getModel(); + } else { + irrelevant++; + continue; + } + + if (envFilter != null && !envFilter.equals(observation.environment)) { + skipped++; + continue; + } + + if (observation.environment != null) { + environmentsSeen.add(observation.environment); + } + + String rawKey = "crypto".equals(observation.kind) + ? "crypto:" + observation.algorithm + : "ai:" + observation.provider + "/" + observation.model; + rawCounts.merge(rawKey, 1, Integer::sum); + + String dedupKey = rawKey + "|" + observation.applicationId + "|" + observation.route; + if (!uniqueObservations.containsKey(dedupKey)) { + uniqueObservations.put(dedupKey, observation); + } + } + + System.out.println(" Filtered to " + (observationList.size() - irrelevant) + " crypto/AI-usage observations"); + if (skipped > 0) { + System.out.println(" Filtered to " + (observationList.size() - irrelevant - skipped) + " (env: " + envFilter + ")"); + } + System.out.println(" Deduplicated to " + uniqueObservations.size() + " unique observations"); + + System.out.print(" Fetching details for unique observations"); + for (Observation observation : uniqueObservations.values()) { + JsonObject details = fetchObservationDetails(httpClient, observation.id); + addDetailsToObservation(observation, details); + System.out.print('.'); + } + System.out.println(" done"); + + if (!environmentsSeen.isEmpty()) { + System.out.println("\nFetching application architecture/connection graph..."); + try { + appGraphInfo = ApplicationGraphFetcher.fetch(httpClient, gson, baseUrl, orgId, authHeader, apiKey, environmentsSeen); + System.out.println(" Found graph data for " + appGraphInfo.size() + " applications"); + } catch (IOException e) { + System.out.println(" Skipping graph enrichment (" + e.getMessage() + ")"); + } + } + + return new ArrayList<>(uniqueObservations.values()); + } + } + + private JsonArray fetchObservationsList(CloseableHttpClient httpClient) throws IOException { + String url = baseUrl + "/organizations/" + orgId + "/observations"; + HttpPost post = new HttpPost(url); + + post.setHeader("Authorization", authHeader); + post.setHeader("API-Key", apiKey); + post.setHeader("Content-Type", "application/json"); + post.setHeader("Accept", "application/json"); + + String requestBody = "{" + + "\"observationOrigins\":[\"OBSERVABILITY\"]," + + "\"values\":[\"MLKEM\",\"ML-KEM\",\"ML-DSA\",\"FN-DSA\"]," + + "\"excludeValues\":true," + + "\"pageable\":{" + + "\"pageSize\":1000," + + "\"sort\":[{\"property\":\"EVENT_TIME\",\"direction\":\"desc\"}]," + + "\"sortAfter\":[]" + + "}" + + "}"; + post.setEntity(new StringEntity(requestBody)); + + HttpResponse response = httpClient.execute(post); + int statusCode = response.getStatusLine().getStatusCode(); + String responseBody = EntityUtils.toString(response.getEntity()); + + if (statusCode != 200) { + throw new IOException("API returned status " + statusCode + ": " + responseBody); + } + + JsonObject jsonResponse = gson.fromJson(responseBody, JsonObject.class); + if (jsonResponse == null || !jsonResponse.has("observations")) { + throw new IOException("Invalid API response"); + } + + return jsonResponse.getAsJsonArray("observations"); + } + + private JsonObject fetchObservationDetails(CloseableHttpClient httpClient, String observationId) throws IOException { + String url = baseUrl + "/organizations/" + orgId + "/observations/" + observationId + "/details"; + HttpGet get = new HttpGet(url); + + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String responseBody = EntityUtils.toString(response.getEntity()); + + if (statusCode != 200) { + throw new IOException("API returned status " + statusCode + " for observation " + observationId); + } + + return gson.fromJson(responseBody, JsonObject.class); + } + + private Observation parseObservationFromList(JsonObject listItem) { + Observation obs = new Observation(); + obs.id = getStringOrNull(listItem, "observationId"); + obs.eventTime = getStringOrNull(listItem, "detectedTime"); + obs.route = getStringOrNull(listItem, "httpRoute"); + obs.applicationId = getStringOrNull(listItem, "applicationId"); + obs.applicationName = getStringOrNull(listItem, "applicationName"); + obs.serverName = getStringOrNull(listItem, "serverName"); + obs.environment = getStringOrNull(listItem, "deploymentTier"); + return obs; + } + + private void addDetailsToObservation(Observation obs, JsonObject details) { + if (details.has("stackTrace") && !details.get("stackTrace").isJsonNull()) { + JsonElement stackTraceElement = details.get("stackTrace"); + if (stackTraceElement.isJsonArray()) { + JsonArray stackTrace = stackTraceElement.getAsJsonArray(); + StringBuilder sb = new StringBuilder(); + for (JsonElement frame : stackTrace) { + if (sb.length() > 0) sb.append("\n"); + sb.append(frame.getAsString()); + } + obs.stackTrace = sb.toString(); + } else if (stackTraceElement.isJsonPrimitive()) { + obs.stackTrace = stackTraceElement.getAsString(); + } + } + } + + private String getStringOrNull(JsonObject obj, String key) { + if (obj.has(key) && !obj.get(key).isJsonNull()) { + return obj.get(key).getAsString(); + } + return null; + } + + public void listApplications(List observations) { + Map appIdToName = new HashMap<>(); + Map appIdToCount = new HashMap<>(); + + for (Observation obs : observations) { + if (obs.applicationId != null && !obs.applicationId.isEmpty()) { + appIdToName.put(obs.applicationId, obs.applicationName); + appIdToCount.merge(obs.applicationId, 1, Integer::sum); + } + } + + System.out.println("\nAvailable applications:"); + System.out.println(" ID Name Observations"); + System.out.println(" ---------------------------------------- -------------------------------------------------------- ------------"); + for (Map.Entry entry : appIdToName.entrySet()) { + String appId = entry.getKey(); + String appName = entry.getValue(); + int count = appIdToCount.get(appId); + System.out.printf(" %-40s %-56s %d%n", appId, appName, count); + } + } + + static class BlueprintResult { + JsonObject document; + String resolvedAppName; + BlueprintResult(JsonObject document, String resolvedAppName) { + this.document = document; + this.resolvedAppName = resolvedAppName; + } + } + + public BlueprintResult generateBlueprint(List observations, String appFilter) { + System.out.println("\nGenerating Blueprint" + (appFilter != null ? " for " + appFilter : " for all applications")); + + List filtered = new ArrayList<>(); + String resolvedAppName = null; + for (Observation obs : observations) { + if (appFilter == null) { + filtered.add(obs); + } else if (appFilter.equals(obs.applicationId) || appFilter.equals(obs.applicationName)) { + filtered.add(obs); + if (resolvedAppName == null && obs.applicationName != null) { + resolvedAppName = obs.applicationName; + } + } + } + System.out.println(" Processing " + filtered.size() + " observations"); + + // Group observations by app + Map> byApp = new HashMap<>(); + Map appIdToName = new HashMap<>(); + Map appIdToEnv = new HashMap<>(); + for (Observation obs : filtered) { + String appKey = obs.applicationId != null ? obs.applicationId : obs.applicationName; + if (appKey == null) continue; + byApp.computeIfAbsent(appKey, k -> new ArrayList<>()).add(obs); + appIdToName.put(appKey, obs.applicationName); + if (obs.environment != null) { + appIdToEnv.putIfAbsent(appKey, obs.environment); + } + } + + System.out.println(" Found " + byApp.size() + " applications"); + + JsonObject doc = new JsonObject(); + doc.addProperty("$schema", "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json"); + doc.addProperty("specFormat", "CycloneDX"); + doc.addProperty("specVersion", "2.0"); + doc.addProperty("serialNumber", "urn:uuid:" + UUID.randomUUID().toString()); + doc.addProperty("version", 1); + + JsonObject metadata = new JsonObject(); + metadata.addProperty("timestamp", new Date().toInstant().toString()); + doc.add("metadata", metadata); + + JsonArray blueprints = new JsonArray(); + JsonObject blueprint = new JsonObject(); + blueprint.addProperty("bom-ref", "blueprint-1"); + blueprint.addProperty("name", resolvedAppName != null ? "Blueprint - " + resolvedAppName + : (appFilter != null ? "Blueprint - " + appFilter : "Contrast Architecture Blueprint")); + blueprint.addProperty("description", + "Generated from Contrast runtime observability data: application architecture/connections " + + "(contrast-graph) and crypto/AI usage observations, mapped onto the CycloneDX behavior " + + "taxonomy. Does not include threats, controls, or risks - see TM-BOM."); + JsonArray modelTypes = new JsonArray(); + modelTypes.add("architecture"); + modelTypes.add("behavioral"); + blueprint.add("modelTypes", modelTypes); + + // --- Assets: one per known application, plus one per distinct connected entity we + // only know by name (no architecture-graph node of our own for it). --- + Map appAssetRefs = new HashMap<>(); // appId -> asset bom-ref + Map nameToAssetRef = new HashMap<>(); // application/connection name -> asset bom-ref + JsonArray assets = new JsonArray(); + + for (Map.Entry> entry : byApp.entrySet()) { + String appId = entry.getKey(); + String appName = appIdToName.get(appId); + String displayName = appName != null ? appName : appId; + String assetRef = "asset-app-" + sanitizeBomRef(displayName); + appAssetRefs.put(appId, assetRef); + nameToAssetRef.put(displayName, assetRef); + + JsonObject asset = new JsonObject(); + asset.addProperty("bom-ref", assetRef); + asset.addProperty("name", displayName); + asset.addProperty("type", "system"); + + AppGraphInfo graphInfo = appGraphInfo.get(appId); + JsonArray assetProps = new JsonArray(); + if (graphInfo != null) { + if (graphInfo.language != null) { + assetProps.add(property("contrast:language", graphInfo.language)); + } + if (graphInfo.postureScore != null) { + assetProps.add(property("contrast:postureScore", String.valueOf(graphInfo.postureScore))); + } + if (graphInfo.postureSeverity != null) { + assetProps.add(property("contrast:postureSeverity", graphInfo.postureSeverity)); + } + if (graphInfo.openIssuesTotal != null) { + assetProps.add(property("contrast:openIssuesTotal", String.valueOf(graphInfo.openIssuesTotal))); + } + assetProps.add(property("contrast:serverCount", String.valueOf(graphInfo.serverCount))); + assetProps.add(property("contrast:libraryCount", String.valueOf(graphInfo.libraryCount))); + + if (graphInfo.criticality != null) { + JsonObject classification = new JsonObject(); + classification.addProperty("criticality", mapCriticality(graphInfo.criticality)); + asset.add("classification", classification); + } + } + if (assetProps.size() > 0) { + asset.add("properties", assetProps); + } + + String env = appIdToEnv.get(appId); + if (env != null) { + asset.addProperty("zone", "zone-env-" + sanitizeBomRef(env)); + } + + assets.add(asset); + } + + // External assets: connections whose target isn't one of our known applications + // (resolved by applicationId first, falling back to name matching - the + // contrast-graph display name for an app doesn't always match its /observations + // applicationName, so name-only matching would otherwise fabricate duplicates of + // apps we already have an asset for). + int externalCounter = 0; + for (AppGraphInfo graphInfo : appGraphInfo.values()) { + for (String connectedName : graphInfo.connectedApplications) { + if (resolveConnectedAssetRef(graphInfo, connectedName, appAssetRefs, nameToAssetRef) == null) { + String assetRef = "asset-external-" + sanitizeBomRef(connectedName); + nameToAssetRef.put(connectedName, assetRef); + + JsonObject asset = new JsonObject(); + asset.addProperty("bom-ref", assetRef); + asset.addProperty("name", connectedName); + asset.addProperty("type", "system"); + asset.addProperty("description", "Known only as an architecture-graph connection target; no application-level data available."); + assets.add(asset); + externalCounter++; + } + } + } + blueprint.add("assets", assets); + + // --- Zones: one per deployment tier seen --- + JsonArray zones = new JsonArray(); + Set envsSeen = new HashSet<>(appIdToEnv.values()); + for (String env : envsSeen) { + JsonObject zone = new JsonObject(); + zone.addProperty("bom-ref", "zone-env-" + sanitizeBomRef(env)); + zone.addProperty("name", env); + zone.addProperty("type", "deployment"); + zones.add(zone); + } + blueprint.add("zones", zones); + + // --- Flows: architecture-graph connections between assets (direction is not + // preserved by the graph API, so flows are modeled as bidirectional) --- + JsonArray flows = new JsonArray(); + Set seenPairs = new HashSet<>(); + int flowCounter = 0; + for (Map.Entry entry : appGraphInfo.entrySet()) { + String appId = entry.getKey(); + String sourceRef = appAssetRefs.get(appId); + if (sourceRef == null) continue; // app filtered out / not in this blueprint + + for (String connectedName : entry.getValue().connectedApplications) { + String destRef = resolveConnectedAssetRef(entry.getValue(), connectedName, appAssetRefs, nameToAssetRef); + if (destRef == null || destRef.equals(sourceRef)) continue; + + String pairKey = sourceRef.compareTo(destRef) < 0 ? sourceRef + "|" + destRef : destRef + "|" + sourceRef; + if (!seenPairs.add(pairKey)) continue; + + JsonObject flow = new JsonObject(); + flow.addProperty("bom-ref", "flow-" + (++flowCounter)); + flow.addProperty("name", appIdToName.getOrDefault(appId, appId) + " <-> " + connectedName); + flow.addProperty("type", "data"); + flow.addProperty("source", sourceRef); + flow.addProperty("destination", destRef); + flow.addProperty("bidirectional", true); + flows.add(flow); + } + } + blueprint.add("flows", flows); + + // --- Behaviors: crypto/AI usage observations mapped onto the behavior taxonomy --- + // TODO: the Behavior tab's richer per-route data (Contrast's ServiceResourceDto/ + // ActionType model - resources as addressable assets with per-resource actions like + // AUTHN, STORAGE_QUERY, OUTBOUND_SERVICE_CALL) isn't reachable here. Its backend + // (adr-contrastgraph-reader's BehaviorTabController, proxied via adr-explorer-aggregator) + // has no API-Key-authenticated route in contrast-api-gateway - only UI session/XSRF auth + // works today. Revisit once that gap is closed (see PROD-2415). + JsonArray instances = new JsonArray(); + int behaviorCounter = 0; + int unmapped = 0; + for (Observation obs : filtered) { + String appKey = obs.applicationId != null ? obs.applicationId : obs.applicationName; + String actorRef = appKey != null ? appAssetRefs.get(appKey) : null; + + String tag = "crypto".equals(obs.kind) ? mapCryptoBehavior(obs.algorithm) : mapAiBehavior(); + if (tag == null) { + unmapped++; + continue; + } + + JsonObject instance = new JsonObject(); + instance.addProperty("bom-ref", "behavior-" + (++behaviorCounter)); + instance.addProperty("behavior", tag); + if (actorRef != null) { + JsonArray actors = new JsonArray(); + actors.add(actorRef); + instance.add("actors", actors); + } + instance.addProperty("trigger", obs.route != null ? "api-call" : "unknown"); + instances.add(instance); + } + if (unmapped > 0) { + System.out.println(" " + unmapped + " observation(s) had no behavior-taxonomy mapping, skipped"); + } + JsonObject behaviors = new JsonObject(); + behaviors.add("instances", instances); + blueprint.add("behaviors", behaviors); + + blueprints.add(blueprint); + doc.add("blueprints", blueprints); + + System.out.println(" Created " + assets.size() + " assets (" + externalCounter + " external), " + + zones.size() + " zones, " + flows.size() + " flows, " + instances.size() + " behavior instances"); + + return new BlueprintResult(doc, resolvedAppName); + } + + /** + * Maps a Contrast crypto-algorithm observation onto an entry in the CycloneDX behavior + * taxonomy (behavior-taxonomy.schema.json, security:cryptography:* namespace), based on + * the algorithm's cryptographic primitive. This is necessarily a coarse mapping: the + * taxonomy distinguishes e.g. encrypt vs. decrypt, but a crypto-algorithm observation + * doesn't tell us which direction was used, so a representative tag is chosen per primitive. + */ + private String mapCryptoBehavior(String algorithm) { + if (algorithm == null || algorithm.isEmpty()) return null; + AlgorithmParser parser = new AlgorithmParser(algorithm); + String primitive = parser.getPrimitive(); + if (primitive == null) return "security:cryptography:encryptsData"; + + switch (primitive.toLowerCase()) { + case "ae": + case "block-cipher": + case "stream-cipher": + case "pke": + return "security:cryptography:encryptsData"; + case "hash": + case "xof": + return "security:cryptography:hashesData"; + case "mac": + return "security:cryptography:ensuresIntegrity"; + case "signature": + return "security:cryptography:signsData"; + case "kex": + case "key-agree": + case "kem": + return "security:cryptography:exchangesKey"; + case "kdf": + return "security:cryptography:generatesKey"; + case "drbg": + return "security:cryptography:generatesRandomValue"; + default: + return "security:cryptography:encryptsData"; + } + } + + /** + * AI-usage observations don't distinguish inference/training/agent action types, so all + * are mapped onto the taxonomy's general-purpose generative-AI-call entry. + */ + private String mapAiBehavior() { + return "ai:generative:processesPrompt"; + } + + /** + * Resolves an architecture-graph connection name to the asset bom-ref it actually + * refers to. Prefers resolving by applicationId (via AppGraphInfo.connectedApplicationIds) + * when the connection target is itself a known Contrast application, since the + * contrast-graph display name and the /observations applicationName for the same app + * can differ; falls back to matching on the name string (for server/library clusters, + * or apps outside this blueprint's filter). + */ + private String resolveConnectedAssetRef(AppGraphInfo graphInfo, String connectedName, + Map appAssetRefs, Map nameToAssetRef) { + String connectedAppId = graphInfo.connectedApplicationIds.get(connectedName); + if (connectedAppId != null) { + String ref = appAssetRefs.get(connectedAppId); + if (ref != null) return ref; + } + return nameToAssetRef.get(connectedName); + } + + private String mapCriticality(int criticality) { + if (criticality <= 1) return "minimal"; + if (criticality == 2) return "low"; + if (criticality == 3) return "moderate"; + if (criticality == 4) return "high"; + return "critical"; + } + + private JsonObject property(String name, String value) { + JsonObject p = new JsonObject(); + p.addProperty("name", name); + p.addProperty("value", value); + return p; + } + + private String sanitizeBomRef(String input) { + return input.toLowerCase() + .replaceAll("[^a-z0-9-]", "-") + .replaceAll("-+", "-") + .replaceAll("^-|-$", ""); + } + + public void writeBlueprint(JsonObject document, String filename) throws IOException { + System.out.println("\nWriting Blueprint to " + filename); + + String json = prettyGson.toJson(document); + try (FileWriter writer = new FileWriter(filename)) { + writer.write(json); + } + + System.out.println(" Done!"); + System.out.println("\n Output: " + filename); + } + + // Observation class for holding fetched data (crypto or AI usage) + static class Observation { + String id; + String kind; // "crypto" or "ai" + String algorithm; // crypto only + String provider; // ai only + String model; // ai only + String eventTime; + String route; + String applicationId; + String applicationName; + String serverName; + String environment; + String stackTrace; + } +} diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/Main.java b/src/main/java/com/contrastsecurity/runtimeanalyst/Main.java index 78ea4c8..bda54c9 100644 --- a/src/main/java/com/contrastsecurity/runtimeanalyst/Main.java +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/Main.java @@ -34,12 +34,23 @@ public static void main(String[] args) { ensureAuthenticated(rest); AIBOMGenerator.main(rest); break; + case "blueprint": + ensureAuthenticated(rest); + BlueprintGenerator.main(rest); + break; + case "vex": + ensureAuthenticated(rest); + VEXGenerator.main(rest); + break; case "cbom-advisor": QuantumAdvisor.main(rest); break; case "aibom-advisor": AIAdvisor.main(rest); break; + case "vex-advisor": + VEXAdvisor.main(rest); + break; case "--help": case "-h": printUsage(); @@ -80,10 +91,13 @@ private static void printUsage() { System.out.println(" java -jar runtime-analyst.jar auth [options] Connect to Contrast and generate contrast.properties"); System.out.println(" java -jar runtime-analyst.jar cbom [options] Generate a Cryptography Bill of Materials"); System.out.println(" java -jar runtime-analyst.jar aibom [options] Generate an AI/LLM usage Bill of Materials"); + System.out.println(" java -jar runtime-analyst.jar blueprint [options] Generate a CycloneDX Blueprint (ABOM + Bill of Behaviors)"); + System.out.println(" java -jar runtime-analyst.jar vex [options] Generate a CycloneDX VEX from library-usage and CVE Shield data"); System.out.println(" java -jar runtime-analyst.jar cbom-advisor Re-run the Quantum Advisor against an existing CBOM"); System.out.println(" java -jar runtime-analyst.jar aibom-advisor Re-run the AI Advisor against an existing AI-BOM"); - System.out.println("\n`cbom --analyze` / `aibom --analyze` already run the matching advisor automatically after generation -"); - System.out.println("the standalone cbom-advisor/aibom-advisor commands are for re-running the advisor without regenerating the BOM."); + System.out.println(" java -jar runtime-analyst.jar vex-advisor Re-run the VEX Advisor against an existing VEX"); + System.out.println("\n`cbom --analyze` / `aibom --analyze` / `vex --analyze` already run the matching advisor automatically after"); + System.out.println("generation - the standalone *-advisor commands are for re-running the advisor without regenerating the file."); System.out.println("\nRun with -h after a subcommand for its options, e.g.:"); System.out.println(" java -jar runtime-analyst.jar cbom -h"); System.out.println(" java -jar runtime-analyst.jar aibom -h"); diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java new file mode 100644 index 0000000..9c1e895 --- /dev/null +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXAdvisor.java @@ -0,0 +1,699 @@ +package com.contrastsecurity.runtimeanalyst; + +import java.io.FileReader; +import java.io.FileWriter; +import java.io.IOException; +import java.time.LocalDateTime; +import java.time.format.DateTimeFormatter; +import java.util.ArrayList; +import java.util.Comparator; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Map; + +import com.google.gson.Gson; +import com.google.gson.GsonBuilder; +import com.google.gson.JsonArray; +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * Review of a CycloneDX VEX document produced by VEXGenerator - not a second opinion on whether the CVE + * exists (Contrast's runtime data already establishes that), but a sanity check on whether each + * "not_affected"/"in_triage" CLAIM is well-supported given the CVE's severity/exploitability, or whether a + * human should look at it before relying on it. + * + * WHICH claims need review is decided deterministically (see needsReview()), not by an AI call - every input + * (severity, CISA KEV, EPSS, Assess/ADR enablement, CVE Shield coverage) is already a plain fact sitting on the + * VEX itself, so classifying it per-statement over an AI round-trip added cost and multi-minute latency + * without adding judgment, and made the same VEX produce a different flagged count from run to run on + * identical input - a liability for something meant to be relied on. The one AI call per app is used only for + * the narrative (application_description/risk_level/risk_rationale/recommendation), synthesizing what the + * already-decided facts mean in prose. + * + * Usage: + * java -jar runtime-analyst.jar vex-advisor vex.json [-v] [-o report.md] [--json out.json] [--no-confirm] + */ +public class VEXAdvisor { + + /** + * Which VEX statements are worth a human's attention before being relied on. Deterministic, not an AI call - + * every input here (state/justification, severity, CISA KEV, EPSS, Assess/ADR enablement) is already a plain + * fact sitting on the statement or its app, so classifying it 235 times over an AI round-trip added latency + * and cost without adding judgment: it also made the same VEX produce a different flagged count from run to + * run (21, then 61, then 125, all on identical input), which is a liability for something meant to be relied + * on. The AI's role is now the app-level narrative only - synthesizing what these facts mean in prose, not + * deciding what the facts are. + */ + private boolean needsReview(VexStatement s, AppEntry entry) { + if (s.justification != null) return false; // code_not_reachable / protected_at_runtime - structural, always sound + if ("in_triage".equals(s.state) && s.daysObserved < s.acceptAfterDays) return false; // genuinely still early + boolean assessBlind = isAssessBlind(s, entry); + boolean highSeverity = s.severity != null + && ("critical".equalsIgnoreCase(s.severity) || "high".equalsIgnoreCase(s.severity)); + boolean kev = Boolean.TRUE.equals(s.cisaKev); + boolean highEpss = s.epssScore != null && s.epssScore >= 0.5; + return assessBlind || highSeverity || kev || highEpss; + } + + /** + * Whether Assess had no runtime data anywhere in the environment(s) this claim's evidence spans - a claim + * scoped to ALL (dev/qa/prod combined, the default) is only "blind" if every one of the three lacks data; + * one --env-scoped claim is blind only if that specific environment lacks data. + */ + private boolean isAssessBlind(VexStatement s, AppEntry entry) { + String scope = s.envFilter != null ? s.envFilter : "ALL"; + if ("DEVELOPMENT".equals(scope)) return !"true".equals(entry.assessEnabledDev); + if ("QA".equals(scope)) return !"true".equals(entry.assessEnabledQa); + if ("PRODUCTION".equals(scope)) return !"true".equals(entry.assessEnabledProd); + return !"true".equals(entry.assessEnabledDev) + && !"true".equals(entry.assessEnabledQa) + && !"true".equals(entry.assessEnabledProd); + } + + private static final String ANALYSIS_PROMPT = + "You are an application security analyst writing a short narrative summary of a VEX (Vulnerability " + + "Exploitability eXchange) claim set that a tool generated automatically from Contrast Security runtime " + + "observability data, for ONE application. Which specific claims need review has ALREADY been decided " + + "deterministically (rule: duration-based claims on a CRITICAL/HIGH severity, CISA KEV-listed, or " + + "high-EPSS CVE, or where Assess itself had no runtime data to back the claim) - you're given that list, " + + "not asked to re-derive it. Your job is to turn the given facts into a clear, specific narrative: what's " + + "in this VEX, what's actually worth a second look and why, and what to do about it.\n\n" + + "Return JSON:\n" + + "```json\n" + + "{\n" + + " \"application_description\": \"2-3 sentence overview of this application's VEX posture - how many \"\n" + + " + \"claims, how sound they generally look\",\n" + + " \"risk_level\": \"CRITICAL|HIGH|MEDIUM|LOW|SOUND\",\n" + + " \"risk_rationale\": \"Why this level, naming the specific flagged CVEs/libraries that drove it\",\n" + + " \"recommendation\": \"Specific next action - which CVEs need a human look first, and why those\"\n" + + "}\n" + + "```\n"; + + static class VexStatement { + String cveId; + String purl; + Double score; + String severity; + String state; + String justification; + String detail; + String recommendation; + Double epssScore; + Double epssPercentile; + Boolean cisaKev; + Boolean shieldAvailable; + String envFilter; // "ALL", "DEVELOPMENT", "QA", or "PRODUCTION" - which env(s) this claim's evidence spans + long classesUsed; + long classCount; + long daysObserved; + long acceptAfterDays; + } + + static class AppEntry { + String name; + List statements = new ArrayList<>(); + // "true"/"false"/"" (no agent ever seen in that environment) - see VEXGenerator.ModuleStatus + String assessEnabledDev, assessEnabledQa, assessEnabledProd; + String adrEnabledDev, adrEnabledQa, adrEnabledProd; + } + + private final Gson gson = new GsonBuilder().setPrettyPrinting().create(); + + public static void main(String[] args) { + String vexPath = null; + boolean verbose = false; + String output = null; + String jsonOut = null; + boolean noConfirm = false; + + for (int i = 0; i < args.length; i++) { + String a = args[i]; + if (a.equals("-v") || a.equals("--verbose")) verbose = true; + else if ((a.equals("-o") || a.equals("--output")) && i + 1 < args.length) output = args[++i]; + else if (a.equals("--json") && i + 1 < args.length) jsonOut = args[++i]; + else if (a.equals("--no-confirm")) noConfirm = true; + else if (a.equals("-h") || a.equals("--help")) { + System.out.println("Usage: java -jar runtime-analyst.jar vex-advisor [-v] [-o report.md] [--json out.json] [--no-confirm]"); + return; + } else if (!a.startsWith("-")) { + vexPath = a; + } + } + + if (vexPath == null) { + System.err.println("Error: path to VEX JSON file is required"); + System.exit(1); + } + + try { + new VEXAdvisor().run(vexPath, verbose, output, jsonOut, noConfirm); + } catch (Exception e) { + System.err.println("Error: " + e.getMessage()); + e.printStackTrace(); + System.exit(1); + } + } + + private void run(String vexPath, boolean verbose, String output, String jsonOut, boolean noConfirm) throws Exception { + System.out.println("\nParsing VEX..."); + List entries = parseVex(vexPath); + + int totalStatements = 0; + for (AppEntry e : entries) totalStatements += e.statements.size(); + System.out.println(" Found " + entries.size() + " application(s) with " + totalStatements + " VEX statement(s)"); + + if (entries.isEmpty()) { + System.out.println("\nNo VEX statements found!"); + return; + } + + ClaudeClient client = new ClaudeClient(); + double estimatedCost = client.estimateCost(entries.size(), 1000, 2500); + if (!ClaudeClient.confirmCost(estimatedCost, entries.size(), noConfirm)) { + System.out.println("Cancelled."); + return; + } + + System.out.println("\nAnalyzing " + entries.size() + " application(s)..."); + List results = new ArrayList<>(); + for (AppEntry entry : entries) { + JsonObject result; + try { + result = analyzeApplication(client, entry, verbose); + } catch (Exception e) { + System.out.println(" Error analyzing " + entry.name + ": " + e.getMessage()); + result = new JsonObject(); + result.addProperty("application", entry.name); + result.addProperty("risk_level", "ERROR"); + result.addProperty("application_description", String.valueOf(e.getMessage())); + } + results.add(result); + String risk = getString(result, "risk_level", "UNKNOWN"); + System.out.println(" [" + risk + "] " + entry.name + " (" + entry.statements.size() + " statement(s))"); + } + + int written = writeAssessmentsToVex(vexPath, entries); + if (written > 0) { + System.out.println(" Wrote " + written + " assessment(s) back into " + vexPath); + } + + String report = generateReport(results, entries); + + if (output != null) { + try (FileWriter w = new FileWriter(output)) { + w.write(report); + } + System.out.println("\nReport written to " + output); + } else { + System.out.println("\n" + "=".repeat(60)); + System.out.println(report); + } + + if (jsonOut != null) { + JsonArray arr = new JsonArray(); + for (JsonObject r : results) arr.add(r); + try (FileWriter w = new FileWriter(jsonOut)) { + w.write(gson.toJson(arr)); + } + System.out.println("\nJSON results written to " + jsonOut); + } + + client.printSummary(); + } + + // ---- Parsing ---- + + private List parseVex(String path) throws IOException { + JsonObject vex; + try (FileReader reader = new FileReader(path)) { + vex = gson.fromJson(reader, JsonObject.class); + } + + Map byApp = new LinkedHashMap<>(); + JsonArray vulnerabilities = vex.has("vulnerabilities") ? vex.getAsJsonArray("vulnerabilities") : new JsonArray(); + + for (JsonElement el : vulnerabilities) { + JsonObject v = el.getAsJsonObject(); + Map props = properties(v); + String appName = props.getOrDefault("contrast:appName", "Unknown Application"); + + VexStatement s = new VexStatement(); + s.cveId = getString(v, "id", ""); + if (v.has("affects") && v.getAsJsonArray("affects").size() > 0) { + s.purl = getString(v.getAsJsonArray("affects").get(0).getAsJsonObject(), "ref", null); + } + if (v.has("ratings") && v.getAsJsonArray("ratings").size() > 0) { + JsonObject rating = v.getAsJsonArray("ratings").get(0).getAsJsonObject(); + if (rating.has("score") && !rating.get("score").isJsonNull()) s.score = rating.get("score").getAsDouble(); + s.severity = getString(rating, "severity", null); + } + if (v.has("analysis")) { + JsonObject analysis = v.getAsJsonObject("analysis"); + s.state = getString(analysis, "state", null); + s.justification = getString(analysis, "justification", null); + s.detail = getString(analysis, "detail", null); + } + s.recommendation = getString(v, "recommendation", null); + s.classesUsed = parseLong(props.get("contrast:classesUsed")); + s.classCount = parseLong(props.get("contrast:classCount")); + s.daysObserved = parseLong(props.get("contrast:daysObserved")); + s.acceptAfterDays = parseLong(props.get("contrast:acceptAfterDays")); + s.epssScore = parseDouble(props.get("contrast:epssScore")); + s.epssPercentile = parseDouble(props.get("contrast:epssPercentile")); + String cisaProp = props.get("contrast:cisaKev"); + s.cisaKev = cisaProp != null ? Boolean.parseBoolean(cisaProp) : null; + String shieldProp = props.get("contrast:shieldAvailable"); + s.shieldAvailable = shieldProp != null && !shieldProp.isEmpty() ? Boolean.parseBoolean(shieldProp) : null; + s.envFilter = props.getOrDefault("contrast:envFilter", "ALL"); + + byApp.computeIfAbsent(appName, k -> { + AppEntry e = new AppEntry(); + e.name = k; + return e; + }).statements.add(s); + } + + JsonArray components = vex.has("components") ? vex.getAsJsonArray("components") : new JsonArray(); + for (JsonElement el : components) { + JsonObject c = el.getAsJsonObject(); + if (!"application".equals(getString(c, "type", null))) continue; + String appName = getString(c, "name", null); + AppEntry entry = appName != null ? byApp.get(appName) : null; + if (entry == null) continue; + Map props = properties(c); + entry.assessEnabledDev = props.get("contrast:assessEnabledDev"); + entry.assessEnabledQa = props.get("contrast:assessEnabledQa"); + entry.assessEnabledProd = props.get("contrast:assessEnabledProd"); + entry.adrEnabledDev = props.get("contrast:adrEnabledDev"); + entry.adrEnabledQa = props.get("contrast:adrEnabledQa"); + entry.adrEnabledProd = props.get("contrast:adrEnabledProd"); + } + + return new ArrayList<>(byApp.values()); + } + + private long parseLong(String s) { + if (s == null || s.isEmpty()) return 0L; + try { + return Long.parseLong(s); + } catch (NumberFormatException e) { + return 0L; + } + } + + /** "" (no agent ever seen) is distinct from "false" (agent seen, module explicitly disabled). */ + private String formatEnvFlags(String dev, String qa, String prod) { + return "dev=" + envFlagLabel(dev) + ", qa=" + envFlagLabel(qa) + ", prod=" + envFlagLabel(prod); + } + + private String envFlagLabel(String value) { + if (value == null || value.isEmpty()) return "no data"; + return "true".equals(value) ? "enabled" : "disabled"; + } + + private Double parseDouble(String s) { + if (s == null || s.isEmpty()) return null; + try { + return Double.parseDouble(s); + } catch (NumberFormatException e) { + return null; + } + } + + private Map properties(JsonObject component) { + Map props = new LinkedHashMap<>(); + if (component.has("properties")) { + for (JsonElement el : component.getAsJsonArray("properties")) { + JsonObject p = el.getAsJsonObject(); + props.put(p.get("name").getAsString(), p.get("value").getAsString()); + } + } + return props; + } + + private String getString(JsonObject obj, String key, String def) { + return obj.has(key) && !obj.get(key).isJsonNull() ? obj.get(key).getAsString() : def; + } + + // ---- AI analysis ---- + + private String formatAppForAi(AppEntry entry) { + StringBuilder sb = new StringBuilder(); + sb.append("Application: ").append(entry.name).append("\n\n"); + sb.append("Assess (the module that produces the runtime evidence behind every claim below) enabled: ") + .append(formatEnvFlags(entry.assessEnabledDev, entry.assessEnabledQa, entry.assessEnabledProd)).append("\n"); + sb.append("ADR enabled (classic RASP module, formerly \"Protect\" - not CVE Shield): ") + .append(formatEnvFlags(entry.adrEnabledDev, entry.adrEnabledQa, entry.adrEnabledProd)).append("\n\n"); + + List flagged = new ArrayList<>(); + int sound = 0; + for (VexStatement s : entry.statements) { + if (needsReview(s, entry)) flagged.add(s); + else sound++; + } + + sb.append("Total claims: ").append(entry.statements.size()) + .append(" (sound: ").append(sound).append(", flagged for review: ").append(flagged.size()).append(")\n\n"); + + if (flagged.isEmpty()) { + sb.append("No claims were flagged - every claim is either structural (library unused / CVE Shield ") + .append("actively mitigating) or duration-based on a low/medium-severity, non-KEV, low-EPSS CVE ") + .append("with real Assess data backing it.\n"); + } else { + sb.append("Claims flagged for review (already decided deterministically - explain what's actually ") + .append("going on with these in your narrative, don't just restate the reason tag):\n"); + for (VexStatement s : flagged) { + sb.append("\n- ").append(s.cveId).append(" on ").append(s.purl != null ? s.purl : "unknown library") + .append(" (").append(s.severity != null ? s.severity : "unknown severity") + .append(s.score != null ? ", score " + s.score : "").append(")"); + List tags = new ArrayList<>(); + if (isAssessBlind(s, entry)) tags.add("Assess has no data here"); + if (Boolean.TRUE.equals(s.cisaKev)) tags.add("CISA KEV"); + if (s.epssScore != null && s.epssScore >= 0.5) tags.add("EPSS " + s.epssScore); + if (!tags.isEmpty()) sb.append(" [").append(String.join(", ", tags)).append("]"); + sb.append(" - ").append(s.state).append(", ").append(s.daysObserved).append(" days observed"); + if (s.recommendation != null) sb.append(". Recommendation on record: ").append(s.recommendation); + } + sb.append("\n"); + } + + return sb.toString(); + } + + private JsonObject analyzeApplication(ClaudeClient client, AppEntry entry, boolean verbose) throws Exception { + String entryText = formatAppForAi(entry); + if (verbose) System.out.println(" Analyzing " + entry.name + " (" + entry.statements.size() + " VEX statements)..."); + + String response = client.call(ANALYSIS_PROMPT, entryText, null); + + int start = response.indexOf('{'); + int end = response.lastIndexOf('}'); + if (start >= 0 && end > start) { + try { + JsonObject result = gson.fromJson(response.substring(start, end + 1), JsonObject.class); + result.addProperty("application", entry.name); + return result; + } catch (Exception ignored) { + // fall through to fallback below + } + } + + JsonObject fallback = new JsonObject(); + fallback.addProperty("application", entry.name); + fallback.addProperty("risk_level", "UNKNOWN"); + fallback.addProperty("application_description", "Failed to parse AI response"); + fallback.addProperty("recommendation", response.length() > 500 ? response.substring(0, 500) : response); + return fallback; + } + + /** Short, deterministic explanation of why a statement was (or wasn't) flagged - see needsReview(). */ + private String reviewRationale(VexStatement s, AppEntry entry, boolean flagged) { + if (!flagged) return "sound"; + List reasons = new ArrayList<>(); + if (isAssessBlind(s, entry)) reasons.add("Assess has no runtime data in the environment(s) this claim covers"); + if (s.severity != null && ("critical".equalsIgnoreCase(s.severity) || "high".equalsIgnoreCase(s.severity))) { + reasons.add(s.severity.toUpperCase() + " severity"); + } + if (Boolean.TRUE.equals(s.cisaKev)) reasons.add("CISA KEV-listed"); + if (s.epssScore != null && s.epssScore >= 0.5) reasons.add("EPSS " + s.epssScore); + return "Flagged: " + String.join(", ", reasons) + " - duration-based claim, not a structural guarantee."; + } + + private int writeAssessmentsToVex(String vexPath, List entries) throws IOException { + Map entriesByName = new LinkedHashMap<>(); + for (AppEntry e : entries) entriesByName.put(e.name, e); + + JsonObject vex; + try (FileReader reader = new FileReader(vexPath)) { + vex = gson.fromJson(reader, JsonObject.class); + } + + int written = 0; + JsonArray vulnerabilities = vex.has("vulnerabilities") ? vex.getAsJsonArray("vulnerabilities") : new JsonArray(); + for (JsonElement el : vulnerabilities) { + JsonObject v = el.getAsJsonObject(); + Map props = properties(v); + String appName = props.getOrDefault("contrast:appName", "Unknown Application"); + String cveId = getString(v, "id", null); + AppEntry entry = entriesByName.get(appName); + if (entry == null || cveId == null) continue; + VexStatement s = entry.statements.stream().filter(st -> cveId.equals(st.cveId)).findFirst().orElse(null); + if (s == null) continue; + + boolean flagged = needsReview(s, entry); + JsonArray oldProperties = v.has("properties") ? v.getAsJsonArray("properties") : new JsonArray(); + JsonArray properties = new JsonArray(); + for (JsonElement propEl : oldProperties) { + String name = getString(propEl.getAsJsonObject(), "name", ""); + if (!"contrast:vexAdvisorAssessment".equals(name) && !"contrast:vexAdvisorRationale".equals(name)) { + properties.add(propEl); + } + } + properties.add(propertyJson("contrast:vexAdvisorAssessment", flagged ? "needs_review" : "sound")); + properties.add(propertyJson("contrast:vexAdvisorRationale", reviewRationale(s, entry, flagged))); + v.add("properties", properties); + written++; + } + + if (written > 0) { + try (FileWriter w = new FileWriter(vexPath)) { + w.write(gson.toJson(vex)); + } + } + + return written; + } + + private JsonObject propertyJson(String name, String value) { + JsonObject p = new JsonObject(); + p.addProperty("name", name); + p.addProperty("value", value != null ? value : ""); + return p; + } + + // ---- Report generation ---- + + private String generateReport(List appResults, List entries) { + String reportDate = LocalDateTime.now().format(DateTimeFormatter.ofPattern("MMMM d, yyyy")); + + Map entriesByName = new LinkedHashMap<>(); + for (AppEntry e : entries) entriesByName.put(e.name, e); + + Map riskCounts = new LinkedHashMap<>(); + Map riskByApp = new LinkedHashMap<>(); + for (JsonObject r : appResults) { + String level = getString(r, "risk_level", "UNKNOWN"); + riskCounts.merge(level, 1, Integer::sum); + String app = getString(r, "application", null); + if (app != null) riskByApp.put(app, level); + } + + int totalApps = appResults.size(); + int totalStatements = 0; + for (AppEntry e : entries) totalStatements += e.statements.size(); + + int needsReviewCount = 0; + List kevFlagged = new ArrayList<>(); + List highEpssFlagged = new ArrayList<>(); + for (AppEntry entry : entries) { + for (VexStatement s : entry.statements) { + if (needsReview(s, entry)) { + needsReviewCount++; + if (Boolean.TRUE.equals(s.cisaKev)) kevFlagged.add(s); + else if (s.epssScore != null && s.epssScore >= 0.5) highEpssFlagged.add(s); + } + } + } + + List criticalOrHighApps = new ArrayList<>(); + for (JsonObject r : appResults) { + String level = getString(r, "risk_level", "UNKNOWN"); + if ("CRITICAL".equals(level) || "HIGH".equals(level)) { + criticalOrHighApps.add(getString(r, "application", "Unknown")); + } + } + + StringBuilder sb = new StringBuilder(); + sb.append("\n\n"); + sb.append("# Contrast VEX Advisor\n## Review of Automatically-Generated VEX Claims\n\n---\n\n"); + sb.append("**Report Date:** ").append(reportDate).append("\n"); + sb.append("**Assessment Type:** VEX Claim Soundness Review\n\n---\n\n"); + sb.append("## Summary\n\n"); + sb.append("This report reviews VEX (Vulnerability Exploitability eXchange) claims generated from Contrast ") + .append("Security runtime library-usage and CVE Shield data. It does not re-derive whether a CVE ") + .append("exists - it judges whether each `not_affected`/`in_triage` claim is well-supported enough to rely ") + .append("on as-is, or whether a human should look at it first.\n\n"); + sb.append("**Coverage:** ").append(totalApps).append(" application(s), ").append(totalStatements) + .append(" VEX statement(s) reviewed.\n\n"); + + sb.append("**Key Findings:**\n\n"); + if (needsReviewCount > 0) { + sb.append("- **").append(needsReviewCount).append(" of ").append(totalStatements) + .append(" claim(s) flagged for human review** before relying on them.\n"); + } else { + sb.append("- No claims were flagged for review - all VEX statements look well-supported as generated.\n"); + } + if (!kevFlagged.isEmpty()) { + sb.append("- **").append(kevFlagged.size()) + .append(" flagged claim(s) are on CVEs in the CISA Known Exploited Vulnerabilities (KEV) catalog** - ") + .append("actively exploited in the wild: ").append(formatCveList(kevFlagged, 6)).append(".\n"); + } + if (!highEpssFlagged.isEmpty()) { + sb.append("- **").append(highEpssFlagged.size()) + .append(" flagged claim(s) have an EPSS score ≥ 0.5** (50%+ predicted exploitation likelihood): ") + .append(formatCveList(highEpssFlagged, 6)).append(".\n"); + } + if (!criticalOrHighApps.isEmpty()) { + sb.append("- Application(s) rated CRITICAL/HIGH risk: ").append(String.join(", ", criticalOrHighApps)).append(".\n"); + } + sb.append("\n### Applications\n\n| Application | Risk Level | Statements |\n|-------------|------------|------------|\n"); + for (AppEntry e : entries) { + sb.append("| ").append(e.name).append(" | ").append(riskByApp.getOrDefault(e.name, "UNKNOWN")) + .append(" | ").append(e.statements.size()).append(" |\n"); + } + + sb.append("\n| Risk Level | Applications |\n|------------|--------------|\n"); + for (String level : new String[]{"CRITICAL", "HIGH", "MEDIUM", "LOW", "SOUND", "UNKNOWN"}) { + if (riskCounts.containsKey(level)) { + sb.append("| ").append(level).append(" | ").append(riskCounts.get(level)).append(" |\n"); + } + } + + sb.append("\n### Legend\n\n"); + sb.append("**VEX** - `NA` = not_affected, `IT` = in_triage\n\n"); + sb.append("**Shield** - whether CVE Shield has a virtual patch for this specific CVE at all (a per-CVE, ") + .append("product-level fact - coverage existing anywhere means it's available everywhere Shield is ") + .append("enabled): `Yes` (Shield covers it, even if it hasn't fired), `No` (no Shield coverage for this ") + .append("CVE at all - the claim rests entirely on absence-of-execution, with no possible active ") + .append("backstop), `-` (unknown).\n\n"); + sb.append("**Rationale** - why the claim was made, with the day count for the two duration-based reasons:\n\n"); + sb.append("| Rationale | Meaning |\n|-----------|---------|\n"); + sb.append("| `Library Unused` | Library never loaded at runtime (0 classes) - structural, not time-based |\n"); + sb.append("| `CVE Shielded` | CVE Shield actively mitigating at runtime - an active control, not time-based |\n"); + sb.append("| `CVE Not Used Nd` | not_affected - library loaded, but zero observed executions of the vulnerable path in N days of runtime monitoring, past the acceptance threshold |\n"); + sb.append("| `CVE Watching Nd` | in_triage - zero observed executions in N days so far, still short of the acceptance threshold - may still graduate to `CVE Not Used` |\n\n"); + sb.append("CVEs with no CVE Shield coverage at all never appear in this table - VEXGenerator excludes ") + .append("them entirely rather than claiming `not_affected` or `in_triage` without a detector ever having ") + .append("watched (see its console output for the excluded count).\n\n"); + sb.append("Rows are sorted CISA KEV-listed first, then by EPSS score, then by CVSS score, so the claims worth ") + .append("a second look surface at the top - see the Key Findings above for which specific CVEs those are.\n\n"); + sb.append("**Protection Status** (shown per app below) - Assess is the module that produces the runtime ") + .append("evidence every claim in this report rests on; ADR (formerly branded \"Protect\") is the classic ") + .append("HTTP-rule-based RASP module. Neither is CVE Shield - CVE Shield is a separate product that defends ") + .append("specific CVEs via a microsandbox rather than HTTP rules. Its own coverage is the per-row **Shield** ") + .append("column above - a per-CVE, product-level fact (coverage existing anywhere means it's available ") + .append("everywhere Shield is enabled), not an app- or environment-scoped one.\n"); + + sb.append("\n---\n\n## Application Detail\n\n"); + + List order = java.util.Arrays.asList("CRITICAL", "HIGH", "MEDIUM", "LOW", "SOUND", "UNKNOWN"); + List sortedResults = new ArrayList<>(appResults); + sortedResults.sort(Comparator.comparingInt(r -> { + int idx = order.indexOf(getString(r, "risk_level", "UNKNOWN")); + return idx < 0 ? 99 : idx; + })); + + for (JsonObject r : sortedResults) { + String appName = getString(r, "application", "Unknown"); + AppEntry entry = entriesByName.get(appName); + String riskLevel = getString(r, "risk_level", "UNKNOWN"); + + sb.append("### ").append(appName).append("\n\n**Risk Level:** ").append(riskLevel).append("\n\n"); + if (entry != null) { + sb.append("**Protection Status:** Assess (runtime evidence): ") + .append(formatEnvFlags(entry.assessEnabledDev, entry.assessEnabledQa, entry.assessEnabledProd)) + .append(" · ADR (classic RASP, formerly \"Protect\" - not CVE Shield): ") + .append(formatEnvFlags(entry.adrEnabledDev, entry.adrEnabledQa, entry.adrEnabledProd)) + .append("\n\n"); + } + sb.append(getString(r, "application_description", "No description available.")).append("\n\n"); + sb.append("**Risk Rationale:** ").append(getString(r, "risk_rationale", "Unknown")).append("\n\n"); + sb.append("**Recommendation:** ").append(getString(r, "recommendation", "None")).append("\n\n"); + + if (entry != null) { + List statements = new ArrayList<>(entry.statements); + statements.sort((a, b) -> { + boolean aKev = Boolean.TRUE.equals(a.cisaKev), bKev = Boolean.TRUE.equals(b.cisaKev); + if (aKev != bKev) return aKev ? -1 : 1; + double aEpss = a.epssScore != null ? a.epssScore : -1; + double bEpss = b.epssScore != null ? b.epssScore : -1; + if (aEpss != bEpss) return Double.compare(bEpss, aEpss); + double aScore = a.score != null ? a.score : -1; + double bScore = b.score != null ? b.score : -1; + return Double.compare(bScore, aScore); + }); + + sb.append("| CVE | Library | Score | VEX | Shield | Rationale |\n|-----|---------|-------|-----|--------|-----------|\n"); + for (VexStatement s : statements) { + sb.append("| ").append(s.cveId).append(" | ").append(plainLibrary(s.purl)) + .append(" | ").append(s.score != null ? s.score : "-").append(" | ") + .append("in_triage".equals(s.state) ? "IT" : "NA").append(" | ") + .append(shieldLabel(s.shieldAvailable)).append(" | ") + .append(rationaleWord(s)).append(" |\n"); + } + sb.append("\n"); + } + + sb.append("---\n\n"); + } + + sb.append("## Appendix: Methodology\n\n"); + sb.append("VEX claims were generated by `VEXGenerator` from Contrast runtime library class-usage data and ") + .append("per-environment CVE Shield status - see `vex --help` for the exact decision policy. This ") + .append("advisor does not change any claim; it only assesses whether relying on each claim as generated is ") + .append("reasonable given the CVE's severity and exploitability - it doesn't offer a distinct action per ") + .append("claim, since the real options (verify reachability, upgrade the library) are the same regardless of ") + .append("severity. See the Legend above for how the VEX/Rationale columns are derived, and the Key Findings ") + .append("above for which specific CVEs are CISA KEV-listed or high-EPSS.\n\n"); + sb.append("- **sound**: the claim's justification (structural fact or active control, or a duration comfortably ") + .append("past the threshold on a low-stakes CVE) supports relying on it as-is\n"); + sb.append("- **needs_review**: the claim rests on absence-of-observed-execution for a severe/exploitable CVE, or ") + .append("is otherwise borderline - a human should confirm before treating it as resolved\n\n---\n\n"); + sb.append("*Report generated by Contrast VEX Advisor*\n*Powered by Contrast Security Runtime Observability*\n"); + + return sb.toString(); + } + + /** + * Library Unused/CVE Shielded are structural. CVE Not Used/CVE Watching are duration-based and genuinely + * still accumulating toward (or past) the acceptance threshold. CVEs with no CVE Shield coverage at all + * never reach this report - VEXGenerator excludes them entirely (see its decision-rule 3), since neither + * not_affected nor in_triage is a claim it can support without a detector ever having watched. + */ + private String rationaleWord(VexStatement s) { + if ("code_not_reachable".equals(s.justification)) return "Library Unused"; + if ("protected_at_runtime".equals(s.justification)) return "CVE Shielded"; + if ("in_triage".equals(s.state)) return "CVE Watching " + s.daysObserved + "d"; + return "CVE Not Used " + s.daysObserved + "d"; + } + + /** Whether CVE Shield has any coverage for this CVE at all (org-wide fact) - "-" means unknown. */ + private String shieldLabel(Boolean shieldAvailable) { + if (shieldAvailable == null) return "-"; + return shieldAvailable ? "Yes" : "No"; + } + + /** Strips a purl down to "artifact@version" - drops the "pkg:maven//" prefix for a narrow column. */ + private String plainLibrary(String purl) { + if (purl == null) return "unknown"; + int lastSlash = purl.lastIndexOf('/'); + return lastSlash >= 0 ? purl.substring(lastSlash + 1) : purl; + } + + private String formatCveList(List statements, int max) { + List distinctCves = new ArrayList<>(new java.util.LinkedHashSet<>( + statements.stream().map(s -> s.cveId).collect(java.util.stream.Collectors.toList()))); + StringBuilder sb = new StringBuilder(); + int shown = Math.min(distinctCves.size(), max); + for (int i = 0; i < shown; i++) { + if (i > 0) sb.append(", "); + sb.append(distinctCves.get(i)); + } + if (distinctCves.size() > max) { + sb.append(" (+").append(distinctCves.size() - max).append(" more)"); + } + return sb.toString(); + } + +} diff --git a/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java new file mode 100644 index 0000000..1cd3f05 --- /dev/null +++ b/src/main/java/com/contrastsecurity/runtimeanalyst/VEXGenerator.java @@ -0,0 +1,924 @@ +package com.contrastsecurity.runtimeanalyst; + +import java.io.File; +import java.io.FileInputStream; +import java.io.FileWriter; +import java.io.IOException; +import java.io.InputStream; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Properties; + +import org.apache.http.HttpResponse; +import org.apache.http.client.methods.HttpGet; +import org.apache.http.client.methods.HttpPost; +import org.apache.http.entity.StringEntity; +import org.apache.http.impl.client.CloseableHttpClient; +import org.apache.http.impl.client.HttpClients; +import org.apache.http.util.EntityUtils; + +import org.cyclonedx.Version; +import org.cyclonedx.generators.BomGeneratorFactory; +import org.cyclonedx.generators.json.BomJsonGenerator; +import org.cyclonedx.model.Bom; +import org.cyclonedx.model.Component; +import org.cyclonedx.model.Metadata; +import org.cyclonedx.model.Property; +import org.cyclonedx.model.vulnerability.Vulnerability; +import org.cyclonedx.model.vulnerability.Vulnerability.Advisory; +import org.cyclonedx.model.vulnerability.Vulnerability.Affect; +import org.cyclonedx.model.vulnerability.Vulnerability.Analysis; +import org.cyclonedx.model.vulnerability.Vulnerability.Analysis.Justification; +import org.cyclonedx.model.vulnerability.Vulnerability.Analysis.Response; +import org.cyclonedx.model.vulnerability.Vulnerability.Analysis.State; +import org.cyclonedx.model.vulnerability.Vulnerability.Rating; +import org.cyclonedx.model.vulnerability.Vulnerability.Rating.Method; +import org.cyclonedx.model.vulnerability.Vulnerability.Rating.Severity; +import org.cyclonedx.model.vulnerability.Vulnerability.Source; +import org.cyclonedx.model.vulnerability.Vulnerability.Version.Status; + +import com.google.gson.Gson; +import com.google.gson.JsonArray; +import com.google.gson.JsonElement; +import com.google.gson.JsonObject; + +/** + * Generates a CycloneDX VEX (Vulnerability Exploitability eXchange) document for an + * application's library vulnerabilities, using Contrast's runtime library-usage and + * CVE Shield observation data to justify "not affected"/"in triage" claims + * rather than fabricating them. + * + * Five data sources, all under the same contrast.properties credentials: + * - GET /api/v4/organizations/{org}/applications app first/last seen + * - POST /Contrast/api/ng/{org}/libraries/filter per-library CVEs + runtime class-usage + * - GET /api/ns-ui/v1/organizations/{org}/applications/{id}/cves/issues per-CVE per-environment CVE Shield status + * - GET /Contrast/api/ng/{org}/applications/{id}/servers per-server Assess/ADR module enablement + * - GET /api/ns-ui/v1/organizations/{org}/cves org-wide per-CVE Shield coverage (cveShieldExists) + * + * Decision rules (see CLAUDE.md discussion - these are policy, not spec): + * 1. classes_used == 0 for the app+library -> not_affected / code_not_reachable, unconditional. + * 2. classes_used > 0, CVE's env status is PROTECTING/BLOCKED -> not_affected / protected_at_runtime. + * 3. classes_used > 0, CVE Shield has no coverage for this CVE at all (org-wide cveShieldExists is false - + * see shieldAvailability()) -> no VEX entry. Coverage is a per-CVE, product-level fact, not an + * app/environment-scoped one - if Shield covers a CVE anywhere, it covers it everywhere Shield/ADR is + * enabled. Without it, "not observed executing" isn't evidence of anything (there was never a detector + * watching), so neither not_affected nor in_triage is a claim this tool can support - in_triage would be + * just as wrong, since it implies evidence is accumulating toward a future resolution that nothing here + * could ever produce. This is the same "can't positively account for it" bucket as rule 5 below, just a + * different root cause (no detection capability, vs. confirmed exploitation) - excluded CVEs are counted + * in the run's own console output, not silently dropped. + * 4. classes_used > 0, CVE's env status is NOT_SEEN (or missing) in every environment observed - Shield has + * coverage here (rule 3 didn't apply) and simply hasn't fired, so elapsed time is genuine evidence: + * - days observed >= acceptAfterDays -> not_affected (no justification), detail explains the + * day count and threshold as an operational risk-acceptance, not a structural guarantee. + * - days observed < acceptAfterDays -> in_triage, detail explains the day count so far. + * 5. classes_used > 0, CVE's env status is EXPOSED/EXPLOITED (or unrecognized) -> no VEX entry; + * never suppress a vulnerability we can't positively account for. + * + * Not factored into the decision rules above (deliberately - see ModuleStatus): whether Assess/ADR are + * even enabled per environment. A "not seen" claim scoped to an environment where Assess itself isn't running + * has no runtime evidence behind it at all, but rather than silently changing the claim, that fact is reported + * as its own contrast:assessEnabled and contrast:adrEnabled property (per env) so a human (or the VEX + * Advisor) can weigh it. ADR (formerly branded "Protect") is the classic HTTP-rule-based RASP module (the + * API's `defend` flag) - a separate product from CVE Shield, which defends specific CVEs via a microsandbox. + * + * Usage: + * java -jar runtime-analyst.jar vex --app "MyApp" + * java -jar runtime-analyst.jar vex --list + * java -jar runtime-analyst.jar vex --app "MyApp" --vex-accept-after-days 30 -o vex.json + */ +public class VEXGenerator { + + private static final List PROTECTED_STATUSES = List.of("PROTECTING", "BLOCKED"); + // NO_SHIELD is a real per-app-per-environment status value (confirmed by scanning every app in this org - + // not documented alongside NOT_SEEN/PROTECTING/BLOCKED/etc). It belongs in the same duration-based branch + // as NOT_SEEN below (absence-of-execution is still the applicable reasoning for reaching that branch at + // all) - whether Shield actually has coverage for the CVE is a separate question, decided by the org-wide + // cveShieldExists fact instead (see shieldAvailability()), not by this per-app status. + private static final List NOT_SEEN_STATUSES = List.of("NOT_SEEN", "NO_SHIELD"); + + private String baseUrl; // e.g. https://host/api/ns-ui/v1 + private String host; // e.g. https://host + private String orgId; + private String authHeader; + private String apiKey; + private int acceptAfterDays = 30; + private String envFilter; // DEVELOPMENT, QA, or PRODUCTION - null means consider all three + + // Counts of CVEs deliberately excluded from the VEX (no statement generated) because this tool can't + // positively account for them - tracked so the exclusion is visible in the run's own output, not silent. + private int excludedNoShieldCoverage = 0; + private int excludedExposedOrUnrecognized = 0; + + private final Gson gson = new Gson(); + private final CloseableHttpClient httpClient = HttpClients.createDefault(); + + public VEXGenerator(String configFile) throws IOException { + loadConfig(configFile); + } + + public void setAcceptAfterDays(int days) { + this.acceptAfterDays = days; + } + + public void setEnvFilter(String env) { + this.envFilter = env; + } + + private void loadConfig(String configFile) throws IOException { + Properties props = new Properties(); + File f = configFile != null ? new File(configFile) : new File("contrast.properties"); + if (!f.exists()) { + throw new IOException("Config file not found: " + f.getPath()); + } + try (InputStream is = new FileInputStream(f)) { + props.load(is); + } + baseUrl = props.getProperty("contrast.url"); + orgId = props.getProperty("contrast.org_id"); + authHeader = props.getProperty("contrast.auth_header"); + apiKey = props.getProperty("contrast.api_key"); + if (baseUrl == null || orgId == null || authHeader == null || apiKey == null) { + throw new IOException("contrast.properties is missing one of: contrast.url, contrast.org_id, contrast.auth_header, contrast.api_key"); + } + host = baseUrl.replaceAll("/api/.*", ""); + } + + public static void main(String[] args) { + String appFilter = null; + String envFilter = null; + String outputFile = "vex.json"; + String configFile = null; + boolean listOnly = false; + boolean runAnalysis = false; + int acceptAfterDays = 30; + + for (int i = 0; i < args.length; i++) { + if ("--app".equals(args[i]) && i + 1 < args.length) { + appFilter = args[++i]; + } else if ("--env".equals(args[i]) && i + 1 < args.length) { + envFilter = args[++i].toUpperCase(); + } else if ("--list".equals(args[i])) { + listOnly = true; + } else if ("--analyze".equals(args[i])) { + runAnalysis = true; + } else if ("-o".equals(args[i]) && i + 1 < args.length) { + outputFile = args[++i]; + } else if ("-c".equals(args[i]) && i + 1 < args.length) { + configFile = args[++i]; + } else if ("--vex-accept-after-days".equals(args[i]) && i + 1 < args.length) { + acceptAfterDays = Integer.parseInt(args[++i]); + } else if ("--help".equals(args[i]) || "-h".equals(args[i])) { + printUsage(); + return; + } + } + + try { + VEXGenerator generator = new VEXGenerator(configFile); + generator.setAcceptAfterDays(acceptAfterDays); + generator.setEnvFilter(envFilter); + + List apps = generator.fetchApplications(); + + if (listOnly) { + System.out.println("\nAvailable applications:"); + for (AppInfo app : apps) { + System.out.println(" " + app.name + " (" + app.id + ")"); + } + return; + } + + List targets = new ArrayList<>(); + if (appFilter == null) { + targets.addAll(apps); + } else { + for (AppInfo app : apps) { + if (appFilter.equals(app.id) || appFilter.equalsIgnoreCase(app.name)) { + targets.add(app); + } + } + if (targets.isEmpty()) { + System.err.println("No application matched \"" + appFilter + "\". Use --list to see available applications."); + System.exit(1); + } + } + + Bom bom = generator.generateVEX(targets); + + if (appFilter != null && "vex.json".equals(outputFile)) { + String safe = targets.get(0).name.replaceAll("[^a-zA-Z0-9-_]", "_"); + outputFile = "vex-" + safe + ".json"; + } + + generator.writeVEX(bom, outputFile); + + if (runAnalysis) { + generator.runVEXAdvisor(outputFile); + } + } catch (Exception e) { + System.err.println("Error: " + e.getMessage()); + e.printStackTrace(); + System.exit(1); + } + } + + private static void printUsage() { + System.out.println("\nVEX Generator - Create a CycloneDX VEX from Contrast library-usage and CVE Shield data"); + System.out.println("\nUsage:"); + System.out.println(" java -jar runtime-analyst.jar vex --app Generate a VEX for one application"); + System.out.println(" java -jar runtime-analyst.jar vex Generate a VEX covering all applications"); + System.out.println(" java -jar runtime-analyst.jar vex --list List available applications with IDs"); + System.out.println(" java -jar runtime-analyst.jar vex --env Scope claims to one environment (DEVELOPMENT, QA, PRODUCTION) instead of this app's dev/qa/prod combined"); + System.out.println(" java -jar runtime-analyst.jar vex --vex-accept-after-days Days of no-observed-execution before treating a CVE as not_affected (default 30)"); + System.out.println(" java -jar runtime-analyst.jar vex --analyze Run VEX Advisor AI review after VEX generation"); + System.out.println(" java -jar runtime-analyst.jar vex -o Specify output filename"); + System.out.println(" java -jar runtime-analyst.jar vex -c Use custom config file"); + } + + /** + * Run the VEX Advisor to sanity-check the generated claims, in-process (no Python required). + */ + private void runVEXAdvisor(String vexFile) { + System.out.println("\n" + "=".repeat(60)); + System.out.println("Running VEX Advisor Review..."); + System.out.println("=".repeat(60)); + + String advisorOutput = vexFile.replace(".json", "-advisor.md"); + VEXAdvisor.main(new String[]{vexFile, "--no-confirm", "-o", advisorOutput}); + System.out.println("\nVEX Advisor report written to: " + advisorOutput); + } + + // ---- Data model ---- + + static class AppInfo { + String id; + String name; + long firstSeenTime; + long lastSeenTime; + } + + private static class CveIssue { + String cveId; + String libraryVersion; + String dev; + String qa; + String prod; + } + + // ---- Applications ---- + + public List fetchApplications() throws IOException { + String url = host + "/api/v4/organizations/" + orgId + "/applications?size=500"; + HttpGet get = new HttpGet(url); + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("Applications API returned status " + statusCode + ": " + body); + } + + JsonObject json = gson.fromJson(body, JsonObject.class); + List apps = new ArrayList<>(); + for (JsonElement el : json.getAsJsonArray("content")) { + JsonObject o = el.getAsJsonObject(); + AppInfo app = new AppInfo(); + app.id = getStringOrNull(o, "id"); + app.name = getStringOrNull(o, "name"); + app.firstSeenTime = parseIsoOrEpoch(o, "firstSeenTime"); + app.lastSeenTime = parseIsoOrEpoch(o, "lastSeenTime"); + apps.add(app); + } + return apps; + } + + private long parseIsoOrEpoch(JsonObject o, String field) { + if (!o.has(field) || o.get(field).isJsonNull()) { + return 0L; + } + JsonElement el = o.get(field); + if (el.isJsonPrimitive() && el.getAsJsonPrimitive().isNumber()) { + return el.getAsLong(); + } + try { + return java.time.Instant.parse(el.getAsString()).toEpochMilli(); + } catch (Exception e) { + return 0L; + } + } + + // ---- CVE Shield status, per app (per-CVE per-environment, from cves/issues) ---- + + private Map fetchCveIssues(String appId) throws IOException { + Map issues = new HashMap<>(); + String cursor = ""; + boolean hasMore = true; + + while (hasMore) { + String url = baseUrl + "/organizations/" + orgId + "/applications/" + appId + + "/cves/issues?size=100&sort=cvssScore,desc&pagination=cursor&cursor=" + cursor; + HttpGet get = new HttpGet(url); + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("CVE issues API returned status " + statusCode + ": " + body); + } + + JsonObject json = gson.fromJson(body, JsonObject.class); + for (JsonElement el : json.getAsJsonArray("items")) { + JsonObject o = el.getAsJsonObject(); + CveIssue issue = new CveIssue(); + issue.cveId = getStringOrNull(o, "cveId"); + issue.libraryVersion = getStringOrNull(o, "libraryVersion"); + issue.dev = getStringOrNull(o, "dev"); + issue.qa = getStringOrNull(o, "qa"); + issue.prod = getStringOrNull(o, "prod"); + issues.put(issue.cveId + "|" + issue.libraryVersion, issue); + } + + hasMore = json.has("hasMore") && json.get("hasMore").getAsBoolean(); + cursor = json.has("cursor") && !json.get("cursor").isJsonNull() ? json.get("cursor").getAsString() : ""; + if (cursor.isEmpty()) { + hasMore = false; + } + } + return issues; + } + + // ---- Assess/ADR module enablement, per app ---- + + /** + * `defend` is ADR (formerly branded "Protect"), the HTTP-rule-based RASP module - a different, older + * product from CVE Shield, which defends specific CVEs via a microsandbox rather than HTTP rules. CVE + * Shield's own coverage/status is NOT derived from this flag - see fetchCveShieldStatus below for that. + */ + private static class ModuleStatus { + Boolean assessEnabledDev, assessEnabledQa, assessEnabledProd; + Boolean adrEnabledDev, adrEnabledQa, adrEnabledProd; + } + + private ModuleStatus fetchModuleStatus(String appId) throws IOException { + String url = host + "/Contrast/api/ng/" + orgId + "/applications/" + appId + "/servers"; + HttpGet get = new HttpGet(url); + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("Servers API returned status " + statusCode + ": " + body); + } + + ModuleStatus ps = new ModuleStatus(); + JsonObject json = gson.fromJson(body, JsonObject.class); + if (!json.has("servers")) { + return ps; + } + for (JsonElement el : json.getAsJsonArray("servers")) { + JsonObject server = el.getAsJsonObject(); + String env = getStringOrNull(server, "environment"); + boolean assess = server.has("assess") && !server.get("assess").isJsonNull() && server.get("assess").getAsBoolean(); + boolean adr = server.has("defend") && !server.get("defend").isJsonNull() && server.get("defend").getAsBoolean(); + if ("DEVELOPMENT".equals(env)) { + ps.assessEnabledDev = orTrue(ps.assessEnabledDev, assess); + ps.adrEnabledDev = orTrue(ps.adrEnabledDev, adr); + } else if ("QA".equals(env)) { + ps.assessEnabledQa = orTrue(ps.assessEnabledQa, assess); + ps.adrEnabledQa = orTrue(ps.adrEnabledQa, adr); + } else if ("PRODUCTION".equals(env)) { + ps.assessEnabledProd = orTrue(ps.assessEnabledProd, assess); + ps.adrEnabledProd = orTrue(ps.adrEnabledProd, adr); + } + } + return ps; + } + + // ---- CVE Shield coverage, org-wide (not per app - fetched once per run) ---- + + /** + * Whether Contrast even HAS a CVE Shield virtual patch for a given CVE at all - a different fact from + * whether it's actively catching that CVE for a specific app/environment (which is what the per-app + * devStatus/qaStatus/prodStatus properties, from cves/issues, already report). + */ + private Map fetchCveShieldStatus() throws IOException { + Map cveShieldExists = new HashMap<>(); + String cursor = ""; + boolean hasMore = true; + + while (hasMore) { + String url = baseUrl + "/organizations/" + orgId + + "/cves?size=100&sort=maxCvssScore,desc&pagination=cursor&cursor=" + cursor + + "&dateInterval%5BstartTime%5D=2000-01-01T00:00:00.000Z" + + "&dateInterval%5BendTime%5D=" + java.time.Instant.now(); + HttpGet get = new HttpGet(url); + get.setHeader("Authorization", authHeader); + get.setHeader("API-Key", apiKey); + get.setHeader("Accept", "application/json"); + + HttpResponse response = httpClient.execute(get); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("CVEs API returned status " + statusCode + ": " + body); + } + + JsonObject json = gson.fromJson(body, JsonObject.class); + for (JsonElement el : json.getAsJsonArray("items")) { + JsonObject item = el.getAsJsonObject(); + String cveId = item.has("cve") ? getStringOrNull(item.getAsJsonObject("cve"), "id") : null; + if (cveId != null && item.has("cveShieldExists") && !item.get("cveShieldExists").isJsonNull()) { + cveShieldExists.put(cveId, item.get("cveShieldExists").getAsBoolean()); + } + } + + hasMore = json.has("hasMore") && json.get("hasMore").getAsBoolean(); + cursor = json.has("cursor") && !json.get("cursor").isJsonNull() ? json.get("cursor").getAsString() : ""; + if (cursor.isEmpty()) { + hasMore = false; + } + } + return cveShieldExists; + } + + /** Null (no server seen yet) stays null only if never set; otherwise ORs across multiple servers in the same env. */ + private Boolean orTrue(Boolean existing, boolean value) { + return existing == null ? value : (existing || value); + } + + // ---- Libraries: CVEs + runtime class usage, per app ---- + + private JsonArray fetchLibraries(String appId) throws IOException { + JsonArray allLibraries = new JsonArray(); + int offset = 0; + int limit = 50; + int total = Integer.MAX_VALUE; + + while (offset < total) { + String url = host + "/Contrast/api/ng/" + orgId + + "/libraries/filter?expand=skip_links,apps,quickFilters,vulns,status,usage_counts" + + "&offset=" + offset + "&limit=" + limit + "&sort=score"; + HttpPost post = new HttpPost(url); + post.setHeader("Authorization", authHeader); + post.setHeader("API-Key", apiKey); + post.setHeader("Content-Type", "application/json"); + post.setHeader("Accept", "application/json"); + + JsonObject requestBody = new JsonObject(); + requestBody.addProperty("q", ""); + requestBody.addProperty("quickFilter", "VULNERABLE"); + JsonArray appsArray = new JsonArray(); + appsArray.add(appId); + requestBody.add("apps", appsArray); + requestBody.add("servers", new JsonArray()); + requestBody.add("environments", new JsonArray()); + requestBody.add("grades", new JsonArray()); + requestBody.add("languages", new JsonArray()); + requestBody.add("licenses", new JsonArray()); + requestBody.add("status", new JsonArray()); + requestBody.add("severities", new JsonArray()); + requestBody.add("tags", new JsonArray()); + requestBody.addProperty("includeUnused", true); + requestBody.addProperty("includeUsed", true); + post.setEntity(new StringEntity(gson.toJson(requestBody))); + + HttpResponse response = httpClient.execute(post); + int statusCode = response.getStatusLine().getStatusCode(); + String body = EntityUtils.toString(response.getEntity()); + if (statusCode != 200) { + throw new IOException("Libraries API returned status " + statusCode + ": " + body); + } + + JsonObject json = gson.fromJson(body, JsonObject.class); + JsonArray page = json.getAsJsonArray("libraries"); + for (JsonElement el : page) { + allLibraries.add(el); + } + total = json.has("count") ? json.get("count").getAsInt() : page.size(); + offset += limit; + if (page.size() == 0) { + break; + } + } + return allLibraries; + } + + // ---- VEX generation ---- + + public Bom generateVEX(List apps) throws IOException { + Bom bom = new Bom(); + List vulnerabilities = new ArrayList<>(); + List appComponents = new ArrayList<>(); + + System.out.println("\nFetching org-wide CVE Shield coverage..."); + Map cveShieldExists = fetchCveShieldStatus(); + System.out.println(" " + cveShieldExists.size() + " CVEs with known Shield coverage status"); + + for (AppInfo app : apps) { + System.out.println("\nProcessing " + app.name + " (" + app.id + ")..."); + + Map cveIssues = fetchCveIssues(app.id); + JsonArray libraries = fetchLibraries(app.id); + ModuleStatus protection = fetchModuleStatus(app.id); + System.out.println(" " + libraries.size() + " vulnerable libraries, " + cveIssues.size() + " CVE issue records"); + appComponents.add(buildAppComponent(app, protection)); + + long daysObserved = (app.lastSeenTime > app.firstSeenTime) + ? (app.lastSeenTime - app.firstSeenTime) / (1000L * 60 * 60 * 24) + : 0L; + + for (JsonElement libEl : libraries) { + JsonObject lib = libEl.getAsJsonObject(); + String group = getStringOrNull(lib, "group"); + String fileName = getStringOrNull(lib, "file_name"); + String fileVersion = getStringOrNull(lib, "file_version"); + String hash = getStringOrNull(lib, "hash"); + long classesUsed = lib.has("classes_used") ? lib.get("classes_used").getAsLong() : 0L; + long classCount = lib.has("class_count") ? lib.get("class_count").getAsLong() : 0L; + JsonObject remediationGuidance = lib.has("remediationGuidance") && lib.get("remediationGuidance").isJsonObject() + ? lib.getAsJsonObject("remediationGuidance") : null; + String latestVersion = getStringOrNull(lib, "latest_version"); + + if (!lib.has("vulns")) { + continue; + } + + for (JsonElement vulnEl : lib.getAsJsonArray("vulns")) { + JsonObject vuln = vulnEl.getAsJsonObject(); + String cveId = getStringOrNull(vuln, "name"); + if (cveId == null) { + continue; + } + + Vulnerability v = buildVulnerability( + app, group, fileName, fileVersion, hash, classesUsed, classCount, + cveId, vuln, cveIssues.get(cveId + "|" + fileVersion), daysObserved, + remediationGuidance, latestVersion, cveShieldExists.get(cveId)); + + if (v != null) { + vulnerabilities.add(v); + } + } + } + } + + System.out.println("\nGenerated " + vulnerabilities.size() + " VEX statements."); + if (excludedNoShieldCoverage > 0 || excludedExposedOrUnrecognized > 0) { + System.out.println("Excluded " + (excludedNoShieldCoverage + excludedExposedOrUnrecognized) + + " CVE(s) - no VEX statement generated, since this tool can't positively account for them:"); + if (excludedNoShieldCoverage > 0) { + System.out.println(" " + excludedNoShieldCoverage + " have no CVE Shield coverage at all - " + + "absence-of-execution isn't evidence when nothing was ever watching"); + } + if (excludedExposedOrUnrecognized > 0) { + System.out.println(" " + excludedExposedOrUnrecognized + " are EXPOSED/EXPLOITED (or an " + + "unrecognized status) - genuinely affected, not a claim this tool makes"); + } + } + bom.setVulnerabilities(vulnerabilities); + bom.setComponents(appComponents); + + if (apps.size() == 1) { + Metadata metadata = new Metadata(); + metadata.setComponent(appComponents.get(0)); + bom.setMetadata(metadata); + } + + return bom; + } + + /** Carries Assess/ADR module-enablement facts (see ModuleStatus) - one per app, not repeated per statement. */ + private Component buildAppComponent(AppInfo app, ModuleStatus protection) { + Component appComponent = new Component(); + appComponent.setType(Component.Type.APPLICATION); + appComponent.setName(app.name); + appComponent.setBomRef(sanitizeBomRef(app.id)); + + List properties = new ArrayList<>(); + properties.add(property("contrast:assessEnabledDev", enabledLabel(protection.assessEnabledDev))); + properties.add(property("contrast:assessEnabledQa", enabledLabel(protection.assessEnabledQa))); + properties.add(property("contrast:assessEnabledProd", enabledLabel(protection.assessEnabledProd))); + properties.add(property("contrast:adrEnabledDev", enabledLabel(protection.adrEnabledDev))); + properties.add(property("contrast:adrEnabledQa", enabledLabel(protection.adrEnabledQa))); + properties.add(property("contrast:adrEnabledProd", enabledLabel(protection.adrEnabledProd))); + appComponent.setProperties(properties); + return appComponent; + } + + /** "" (no data) means no agent was ever seen reporting from that environment - not the same as "disabled". */ + private String enabledLabel(Boolean value) { + return value == null ? "" : String.valueOf(value); + } + + /** Returns null when the CVE shouldn't get a VEX statement at all (exposed/exploited/unrecognized status). */ + private Vulnerability buildVulnerability(AppInfo app, String group, String fileName, String fileVersion, + String hash, long classesUsed, long classCount, String cveId, JsonObject vuln, + CveIssue issue, long daysObserved, JsonObject remediationGuidance, String latestVersion, + Boolean orgWideShieldExists) { + + Vulnerability v = new Vulnerability(); + v.setBomRef(sanitizeBomRef(app.id + "-" + cveId + "-" + hash)); + v.setId(cveId); + + String description = getStringOrNull(vuln, "description"); + if (description != null) { + v.setDescription(description); + } + + Source source = new Source(); + source.setName("NVD"); + source.setUrl("https://nvd.nist.gov/vuln/detail/" + cveId); + v.setSource(source); + + Rating rating = new Rating(); + rating.setSource(source); + if (vuln.has("cvss_3_severity_value")) { + rating.setScore(vuln.get("cvss_3_severity_value").getAsDouble()); + } + String severity = getStringOrNull(vuln, "cvss_3_severity_code"); + if (severity != null) { + rating.setSeverity(Severity.fromString(severity.toLowerCase())); + } + rating.setMethod(Method.CVSSV31); + String vector = getStringOrNull(vuln, "cvss_3_vector"); + if (vector != null) { + rating.setVector(vector); + } + List ratings = new ArrayList<>(); + ratings.add(rating); + v.setRatings(ratings); + + if (vuln.has("references") && vuln.getAsJsonArray("references").size() > 0) { + List advisories = new ArrayList<>(); + for (JsonElement refEl : vuln.getAsJsonArray("references")) { + String refUrl = refEl.isJsonPrimitive() ? refEl.getAsString() : getStringOrNull(refEl.getAsJsonObject(), "url"); + if (refUrl == null || refUrl.isEmpty()) { + continue; + } + Advisory advisory = new Advisory(); + advisory.setUrl(refUrl); + advisories.add(advisory); + } + if (!advisories.isEmpty()) { + v.setAdvisories(advisories); + } + } + + String purl = "pkg:maven/" + (group != null ? group : "unknown") + "/" + artifactNameFrom(fileName) + "@" + fileVersion; + Affect affect = new Affect(); + affect.setRef(purl); + + // Contrast's own remediation guidance (minUpgrade = smallest version that clears this library's + // vulnerabilities) is more actionable than the library's raw latest_version, which may be newer + // than necessary or not actually address this CVE - prefer it when available. + String minUpgradeVersion = remediationGuidance != null + ? getStringOrNull(nestedObject(remediationGuidance, "minUpgrade"), "version") : null; + String maxUpgradeVersion = remediationGuidance != null + ? getStringOrNull(nestedObject(remediationGuidance, "maxUpgrade"), "version") : null; + String recommendedVersion = minUpgradeVersion != null ? minUpgradeVersion : latestVersion; + + List versions = new ArrayList<>(); + org.cyclonedx.model.vulnerability.Vulnerability.Version affectedVersion = + new org.cyclonedx.model.vulnerability.Vulnerability.Version(); + affectedVersion.setVersion(fileVersion); + affectedVersion.setStatus(Status.AFFECTED); + versions.add(affectedVersion); + boolean fixAvailable = recommendedVersion != null && !recommendedVersion.equals(fileVersion); + if (fixAvailable) { + org.cyclonedx.model.vulnerability.Vulnerability.Version fixedVersion = + new org.cyclonedx.model.vulnerability.Vulnerability.Version(); + fixedVersion.setVersion(recommendedVersion); + fixedVersion.setStatus(Status.UNAFFECTED); + versions.add(fixedVersion); + } + affect.setVersions(versions); + + List affects = new ArrayList<>(); + affects.add(affect); + v.setAffects(affects); + + String artifactName = artifactNameFrom(fileName); + if (fixAvailable) { + StringBuilder rec = new StringBuilder("Upgrade " + artifactName + " from " + fileVersion + " to " + + recommendedVersion + " to remediate " + cveId + "."); + if (maxUpgradeVersion != null && !maxUpgradeVersion.equals(recommendedVersion)) { + rec.append(" Latest available release is ").append(maxUpgradeVersion).append("."); + } + v.setRecommendation(rec.toString()); + } else { + v.setRecommendation("No newer release of " + artifactName + " is currently identified; monitor for a " + + "fix and re-run VEX generation periodically."); + } + + Analysis analysis = new Analysis(); + String detail; + + if (classesUsed == 0) { + analysis.setState(State.NOT_AFFECTED); + analysis.setJustification(Justification.CODE_NOT_REACHABLE); + detail = "Library not observed executing at runtime in " + app.name + " - 0 of " + classCount + + " classes loaded (Contrast runtime library-usage data)."; + } else if (issue != null && isProtected(issue)) { + analysis.setState(State.NOT_AFFECTED); + analysis.setJustification(Justification.PROTECTED_AT_RUNTIME); + detail = "CVE Shield is actively mitigating this vulnerability at runtime in " + app.name + + " (" + envScopeLabel() + ")."; + } else if (Boolean.FALSE.equals(shieldAvailability(orgWideShieldExists))) { + // CVE Shield has no coverage for this CVE at all - there was never anything watching for an exploit + // attempt, so "not observed executing" isn't evidence of anything, and neither not_affected nor + // in_triage is a claim we can support. in_triage would be just as wrong: it implies evidence is + // accumulating toward a future resolution, but nothing is running that could ever produce one. This + // is the same "can't positively account for it" bucket as EXPOSED/EXPLOITED below - no VEX entry. + excludedNoShieldCoverage++; + return null; + } else if (issue != null && isNotSeen(issue)) { + detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used) but this CVE's " + + "vulnerable code path has not been observed executing in " + app.name + " (" + envScopeLabel() + + ") in " + daysObserved + " days of runtime monitoring"; + if (daysObserved >= acceptAfterDays) { + analysis.setState(State.NOT_AFFECTED); + detail += " (policy threshold: " + acceptAfterDays + " days). Operational risk acceptance based on " + + "runtime observation, not a structural non-reachability guarantee."; + } else { + analysis.setState(State.IN_TRIAGE); + detail += " (below the " + acceptAfterDays + "-day acceptance threshold)."; + } + } else if (issue == null) { + // Library confirmed used, but no matching per-CVE environment record found at all - + // treat the same as "not seen" using the same duration logic, but flag the missing join. + detail = "Library loaded (" + classesUsed + " of " + classCount + " classes used); no per-environment " + + "CVE Shield/exposure record found for this CVE+version in " + app.name + ". Not observed " + + "executing in " + daysObserved + " days of runtime monitoring for this application"; + if (daysObserved >= acceptAfterDays) { + analysis.setState(State.NOT_AFFECTED); + detail += " (policy threshold: " + acceptAfterDays + " days). Operational risk acceptance based on " + + "runtime observation, not a structural non-reachability guarantee."; + } else { + analysis.setState(State.IN_TRIAGE); + detail += " (below the " + acceptAfterDays + "-day acceptance threshold)."; + } + } else { + // EXPOSED / EXPLOITED / any unrecognized status - never suppress. + excludedExposedOrUnrecognized++; + return null; + } + + analysis.setDetail(detail); + + List responses = new ArrayList<>(); + if (analysis.getJustification() == Justification.PROTECTED_AT_RUNTIME) { + // The active CVE Shield control is itself the mitigation in place. + responses.add(Response.WORKAROUND_AVAILABLE); + } else if (analysis.getJustification() != Justification.CODE_NOT_REACHABLE && fixAvailable) { + responses.add(Response.UPDATE); + } + if (!responses.isEmpty()) { + analysis.setResponses(responses); + } + + v.setAnalysis(analysis); + + List properties = new ArrayList<>(); + properties.add(property("contrast:appId", app.id)); + properties.add(property("contrast:appName", app.name)); + properties.add(property("contrast:classesUsed", String.valueOf(classesUsed))); + properties.add(property("contrast:classCount", String.valueOf(classCount))); + properties.add(property("contrast:daysObserved", String.valueOf(daysObserved))); + properties.add(property("contrast:acceptAfterDays", String.valueOf(acceptAfterDays))); + properties.add(property("contrast:envFilter", envFilter != null ? envFilter : "ALL")); + if (vuln.has("epss_score") && !vuln.get("epss_score").isJsonNull()) { + properties.add(property("contrast:epssScore", String.valueOf(vuln.get("epss_score").getAsDouble()))); + } + if (vuln.has("epss_percentile") && !vuln.get("epss_percentile").isJsonNull()) { + properties.add(property("contrast:epssPercentile", String.valueOf(vuln.get("epss_percentile").getAsDouble()))); + } + if (vuln.has("cisa") && !vuln.get("cisa").isJsonNull()) { + properties.add(property("contrast:cisaKev", String.valueOf(vuln.get("cisa").getAsBoolean()))); + } + Boolean shieldAvailable = shieldAvailability(orgWideShieldExists); + if (shieldAvailable != null) { + properties.add(property("contrast:shieldAvailable", String.valueOf(shieldAvailable))); + } + if (latestVersion != null) { + properties.add(property("contrast:latestVersion", latestVersion)); + } + if (issue != null) { + properties.add(property("contrast:devStatus", issue.dev)); + properties.add(property("contrast:qaStatus", issue.qa)); + properties.add(property("contrast:prodStatus", issue.prod)); + } + v.setProperties(properties); + + return v; + } + + /** + * With no --env filter, a claim considers all three of the app's own environments (dev/qa/prod). + * With --env, it's scoped to just that one - e.g. --env PRODUCTION means "protected in production", + * not "protected somewhere, possibly only in dev". + */ + private List statusesToConsider(CveIssue issue) { + if (envFilter == null) { + return java.util.Arrays.asList(issue.dev, issue.qa, issue.prod); + } + switch (envFilter) { + case "DEVELOPMENT": return java.util.Arrays.asList(issue.dev); + case "QA": return java.util.Arrays.asList(issue.qa); + case "PRODUCTION": return java.util.Arrays.asList(issue.prod); + default: return java.util.Arrays.asList(issue.dev, issue.qa, issue.prod); + } + } + + private String envScopeLabel() { + return envFilter != null ? envFilter.toLowerCase() : "across its own dev/qa/prod environments"; + } + + private boolean isProtected(CveIssue issue) { + for (String status : statusesToConsider(issue)) { + if (isProtectedStatus(status)) return true; + } + return false; + } + + private boolean isProtectedStatus(String status) { + return status != null && PROTECTED_STATUSES.contains(status); + } + + private boolean isNotSeen(CveIssue issue) { + for (String status : statusesToConsider(issue)) { + if (!isNotSeenOrNull(status)) return false; + } + return true; + } + + private boolean isNotSeenOrNull(String status) { + return status == null || NOT_SEEN_STATUSES.contains(status); + } + + /** + * Whether CVE Shield could catch this CVE at all - this is a per-CVE, product-level fact (does Contrast + * ship a virtual patch definition for it), NOT something that varies by app or environment: coverage + * existing anywhere means it's available everywhere Shield/ADR is enabled. So this is just the org-wide + * cveShieldExists flag from /cves, verbatim - no per-app inference. (An earlier version of this method + * tried to infer availability from per-environment NO_SHIELD/NOT_SEEN status instead, which happened to + * agree with the org-wide fact in every case checked so far, but was solving the wrong problem - it can't + * distinguish "no coverage exists" from "this app's agent hasn't received the rule yet," and coverage + * itself simply isn't an app/environment-scoped concept.) + */ + private Boolean shieldAvailability(Boolean orgWideShieldExists) { + return orgWideShieldExists; + } + + private String artifactNameFrom(String fileName) { + if (fileName == null) { + return "unknown"; + } + // e.g. "spring-web-4.3.9.release.jar" -> "spring-web"; best-effort, not exact for all naming schemes. + String withoutExt = fileName.replaceAll("\\.jar$", ""); + return withoutExt.replaceAll("-\\d.*$", ""); + } + + private JsonObject nestedObject(JsonObject obj, String field) { + return obj.has(field) && obj.get(field).isJsonObject() ? obj.getAsJsonObject(field) : null; + } + + private Property property(String name, String value) { + Property p = new Property(); + p.setName(name); + p.setValue(value != null ? value : ""); + return p; + } + + private String sanitizeBomRef(String input) { + return input.toLowerCase() + .replaceAll("[^a-z0-9-]", "-") + .replaceAll("-+", "-") + .replaceAll("^-|-$", ""); + } + + private String getStringOrNull(JsonObject obj, String field) { + return obj != null && obj.has(field) && !obj.get(field).isJsonNull() ? obj.get(field).getAsString() : null; + } + + public void writeVEX(Bom bom, String filename) throws Exception { + System.out.println("\nWriting VEX to " + filename); + BomJsonGenerator generator = BomGeneratorFactory.createJson(Version.VERSION_16, bom); + String json = generator.toJsonString(); + try (FileWriter writer = new FileWriter(filename)) { + writer.write(json); + } + System.out.println(" Done!"); + } +}