Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BULK PR] Tracking: HTTP Download of Dependencies Maven #8

Open
JLLeitschuh opened this issue Jul 1, 2022 · 0 comments
Open

[BULK PR] Tracking: HTTP Download of Dependencies Maven #8

JLLeitschuh opened this issue Jul 1, 2022 · 0 comments

Comments

@JLLeitschuh
Copy link
Owner

No description provided.

JLLeitschuh added a commit to JLLeitschuh/adamcin__crx-content-package-deployer that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
49683f1 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/aesanch2__salesforce-migration-assistant that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
d48a83b 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
@JLLeitschuh JLLeitschuh mentioned this issue Jul 1, 2022
Open
JLLeitschuh added a commit to JLLeitschuh/confluentinc__castle that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
9e30e4e 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
This was referenced Jul 1, 2022
Open
Open
JLLeitschuh added a commit to JLLeitschuh/apache__logging-log4j1 that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
8c79a61 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
@JLLeitschuh JLLeitschuh mentioned this issue Jul 1, 2022
Closed
JLLeitschuh added a commit to JLLeitschuh/GistLabs__mechanize that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
750fa5e 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/ibm__microprofile-meeting-websockets that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
95ff80f 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
This was referenced Jul 1, 2022
Open
Closed
JLLeitschuh added a commit to JLLeitschuh/Sage-Bionetworks__file-proxy that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
7ae6f07 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/hubspot__jmte that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
eee1c8a 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
@JLLeitschuh JLLeitschuh mentioned this issue Jul 1, 2022
Open
JLLeitschuh added a commit to JLLeitschuh/neo4j__jsr311-api that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
d6d213f 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/junoyoon__simpleupdatesiterepo that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
15c2072 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
@JLLeitschuh JLLeitschuh mentioned this issue Jul 1, 2022
Open
JLLeitschuh added a commit to JLLeitschuh/hpcloud__cloudfoundry-jenkins that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
de075e5 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
@JLLeitschuh JLLeitschuh mentioned this issue Jul 1, 2022
Open
JLLeitschuh added a commit to JLLeitschuh/JetBrains__intellij-deps-log4j that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
9615158 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/ibm__microprofile-meeting-concurrency that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
0ed50c8 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
@JLLeitschuh JLLeitschuh mentioned this issue Jul 1, 2022
Open
JLLeitschuh added a commit to JLLeitschuh/alibaba__tamper that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
35f7130 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/ibm__microprofile-meeting-persistence that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
9e35cf6 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/infowangxin__springmvc that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
b8f1ce3 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/quartz-scheduler__quartz that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
e699c7f 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/elastic__elasticsearch-hdfs that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
0acc205 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/tamingtext__book that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
909ada2 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
JLLeitschuh added a commit to JLLeitschuh/khuxtable__wagon-gitsite that referenced this issue Jul 1, 2022
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
33addc4 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
This was referenced Dec 18, 2023
Open
Open
Merged
Open
Open
Open
Open
Merged
Open
JLLeitschuh added a commit to BulkSecurityGeneratorProjectV2/hongmaple__HtxkEmsm that referenced this issue Dec 18, 2023
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
1ef11b4 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8


Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D

Co-authored-by: Moderne <[email protected]>
This was referenced Dec 18, 2023
Open
Open
Open
Open
Open
Open
Open
Open
Open
Merged
Surfrdan pushed a commit to fcrepo/fcrepo that referenced this issue Dec 18, 2023
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#…
1bd7a64 
…2070)

This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8


Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D

Co-authored-by: Moderne <[email protected]>
@JLLeitschuh JLLeitschuh mentioned this issue Dec 18, 2023
Open
korydraughn pushed a commit to DICE-UNC/jargon that referenced this issue Dec 20, 2023
@JLLeitschuh @TeamModerne @korydraughn
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
22bd994 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8


Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D

Co-authored-by: Moderne <[email protected]>
jodastephen pushed a commit to JodaOrg/joda-time-jsptags that referenced this issue Dec 21, 2023
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#3)
6eb75d1 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8


Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D

Co-authored-by: Moderne <[email protected]>
mawensen pushed a commit to mawensen/HRAdmin-Backend that referenced this issue Dec 26, 2023
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#2)
03f81b5 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8


Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D

Co-authored-by: Moderne <[email protected]>
basil pushed a commit to JLLeitschuh/jenkinsci__json-lib that referenced this issue Apr 11, 2024
@JLLeitschuh @TeamModerne @basil
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
a2be0b9 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
basil pushed a commit to jenkinsci/json-lib that referenced this issue Apr 11, 2024
@TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#7)
a067f6c 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSSS: 8.1
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8

Co-authored-by: Moderne <[email protected]>
ppaglilla pushed a commit to GoogleCloudPlatform/zetasql-toolkit that referenced this issue May 4, 2024
@JLLeitschuh @TeamModerne
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#30)
5f360f5 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8


Use this link to re-run the recipe: https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories?organizationId=R29vZ2xl

Co-authored-by: Moderne <[email protected]>
ppaglilla added a commit to GoogleCloudPlatform/zetasql-toolkit that referenced this issue May 6, 2024
@ppaglilla @dion-ricky
@JLLeitschuh @TeamModerne @hamnis
Release v0.5.0 (#37)
c8c24d9 
* Update ZetaSQL to version 2023.10.1

* Rewrite queries to fully quote all name paths before analysis

* Avoid no longer necessary nesting of tables in catalogs

* Update query rewritting to only re-quote name paths that refer to resources (i.e. tables, functions, etc)

* Avoid no longer necessary nesting of functions in catalogs

* Avoid no longer necessary nesting of TVFs in catalogs

* Remove unnecessary slf4j dependency

Closes #24

* Reduce code duplication in BigQueryCatalog

* Reduce the amount of nesting for procedures in catalogs

* Avoid duplicate code when creating different types of resources in catalogs

* Use the DOUBLE type kind for BigQuery FLOAT64 columns

Closes #25

* Added extractColumnLevelLineage for ResolvedQueryStmt
Closes #28

* Changed the access modifier of ParentColumnFinder to public
Closes #28

* Make ColumnLineageExtractor accept only concrete statement types

Previously, the API for ColumnLineageExtractor used the method
::extractColumnLevelLineage(ResolvedStatement). Since introducing
support for ResolvedQueryStmts, which needs specifying an output table
separately; maintaining the generic ResolvedStatement API required
making it confusing, since it would optionally need to accept an output
table.

This makes it so that teams building lineage applications need to
explicitly determine the statements they support and call the
corresponding ::extractColumnLevelLineage() method. Such as
::extractColumnLevelLineage(ResolvedInsertStmt) or
::extractColumnLevelLineage(ResolvedQueryStmt, String).

* Bump development version to 0.5.0-SNAPSHOT

* vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#30)

This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#8


Use this link to re-run the recipe: https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories?organizationId=R29vZ2xl

Co-authored-by: Moderne <[email protected]>

* Make the type parser case insensitive (#35)

The type parser was previously case sensitive, while SQL types are case insensitive. This went unnoticed for a while since upper-cased types are usually always used, but is fundamentally incorrect.

Fixes #32

* Add reflection-based patching of GRPC's default max nesting depth (#36)

ZetaSQL's Java API uses a GRPC service to call into the actual C++ implementation of ZetaSQL. By default, the serialization logic of that communication allows for a nesting depth in protobuf messages of up to 100. However, long queries can exceed that level of nesting and as a result cannot be analyzed by default.

This implements a reflection-based patch that allows users to override
that limit to a greater number. This is brittle by design and should
be used with caution.

Fixes #31

* Upgrade to zetasql-2024-03-01 and bump deps (#33)

* Upgrade to zetasql-2024-03-01 and bump deps

* Enable all features

* Rollback Mockito to version 4.11.0

* Remove some v1.4 language options not supported by BigQuery

---------

Co-authored-by: Pablo Paglilla <[email protected]>

* Add missing @return in catalog Javadocs

* Update version to v0.5.0

---------

Co-authored-by: Dion Ricky Saputra <[email protected]>
Co-authored-by: Jonathan Leitschuh <[email protected]>
Co-authored-by: Moderne <[email protected]>
Co-authored-by: Erlend Hamnaberg <[email protected]>
JacksonTian pushed a commit to aliyun/darabonba-crypto-util that referenced this issue Jun 17, 2024
@JLLeitschuh @TeamModerne @JacksonTian
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291
231d186 
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.

Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#8


Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D

Co-authored-by: Moderne <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@JLLeitschuh