Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

graal-sdk 22.0.0.2 has 6 vulnerabilities

See original GitHub issue

The develop branch comes with graal-sdk 22.0.0.2:

mvn dependency:tree -Dincludes=org.graalvm.sdk:graal-sdk

[INFO] com.intuit.karate:karate-core:jar:1.3.0-SNAPSHOT
[INFO] \- org.graalvm.js:js-scriptengine:jar:22.0.0.2:compile
[INFO]    \- org.graalvm.sdk:graal-sdk:jar:22.0.0.2:compile

Snyk reports 6 vulnerabilities for graal-sdk 22.0.0.2: https://security.snyk.io/package/maven/org.graalvm.sdk:graal-sdk/22.0.0.2

https://nvd.nist.gov/vuln/detail/CVE-2022-21434 Unsafe Reflection
https://nvd.nist.gov/vuln/detail/CVE-2022-21426 Denial of Service (DoS)
https://nvd.nist.gov/vuln/detail/CVE-2022-21443 Denial of Service (DoS)
https://nvd.nist.gov/vuln/detail/CVE-2022-21476 Information Exposure
https://nvd.nist.gov/vuln/detail/CVE-2022-21496 Improper Input Validation
https://nvd.nist.gov/vuln/detail/CVE-2022-21449 Access Restriction Bypass

Please upgrade to a fixed version of Graal.

Issue Analytics

State:
Created a year ago
Comments:13 (8 by maintainers)

Top GitHub Comments

1reaction

ptrthomascommented, Nov 4, 2022

thanks @edwardsph and @lukasz-gosiewski for the feedback !

1reaction

lukasz-gosiewskicommented, Nov 4, 2022

@ptrthomas I just migrated to 1.4.0.RC1 and it works perfect. That was a really fast reaction, thank you!

Top Results From Across the Web

org.graalvm.sdk:graal-sdk 22.0.0.2 vulnerabilities | Snyk

Affected versions of this package are vulnerable to Denial of Service (DoS) by allowing unauthenticated attackers with network access via multiple protocols to ......

Current version of graal-sdk contains several vulnerabilities

org.graalvm.sdk:graal-sdk@21.3.0 contains several vulnerabilities: ... Final (that we will release next week) and 22.0.0.2 for main .

22.2.0 - GraalVM

GraalVM is a high-performance JDK distribution written for Java and other JVM languages, along with support for JavaScript, Ruby, Python, ...

org.graalvm.sdk : graal-sdk - Maven Central Repository Search

Graal Sdk - GraalVM is an ecosystem for compiling and running applications written in multiple languages. GraalVM removes the isolation between programming ...

org.graalvm.sdk » graal-sdk - Maven Repository

Version Vulnerabilities Repository Usages Date 22.3.x 22.3.0 Central 31 Oct 18, 2022 22.2.x 22.3.x 22.2.0.1 Central 12 Oct 11, 2022 22.2.x 22.2.0 Central 34 Jul 19,...