Security issue

There is a moderate vulnerability in one of your dependencies

Vulnerable module: com.google.guava:guava

Libraries affected:

• io.springfox:springfox-swagger2@2.9.2

• io.springfox:springfox-swagger-ui@2.9.2

Explanation:

com.google.guava:guava is a set of core libraries that includes new collection types (such as multimap and multiset,immutable collections, a graph library, functional types, an in-memory cache and more.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data.

During deserialization, two Guava classes accept a caller-specified size parameter and eagerly allocate an array of that size:

• AtomicDoubleArray (when serialized with Java serialization)
• CompoundOrdering (when serialized with GWT serialization)

An attacker may be able to send a specially crafted request which with then cause the server to allocate all it’s memory, without validation whether the data size is reasonable.

You have to update this dependency to solve the issue.

[diego-ruiz-rei]

Hello, just want to also bring up this additional security issue with earlier versions of guava - https://nvd.nist.gov/vuln/detail/CVE-2018-10237

[stale[bot]]

This issue has been automatically closed because it has not had recent activity. Please re-open a new issue if this is still an issue.