Skip to content

Conversation

@rotemplay
Copy link
Contributor

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • embedded-minio/pom.xml

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Upgrade Breaking Change Exploit Maturity
medium severity 112/1000
Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 53, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.86, Score Version: V5
Observable Timing Discrepancy
SNYK-JAVA-ORGBOUNCYCASTLE-6277381
io.minio:minio:
8.5.9 -> 8.5.10
No No Known Exploit
high severity 170/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 12, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.83, Score Version: V5
Infinite loop
SNYK-JAVA-ORGBOUNCYCASTLE-6612984
io.minio:minio:
8.5.9 -> 8.5.10
No Proof of Concept
medium severity 157/1000
Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 11, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.61, Score Version: V5
Observable Discrepancy
SNYK-JAVA-ORGBOUNCYCASTLE-6613076
io.minio:minio:
8.5.9 -> 8.5.10
No Proof of Concept
medium severity 50/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 11, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.08, Score Version: V5
Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGBOUNCYCASTLE-6613079
io.minio:minio:
8.5.9 -> 8.5.10
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

@codecov
Copy link

codecov bot commented Apr 26, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.46%. Comparing base (4064748) to head (cf677be).

Additional details and impacted files
@@              Coverage Diff               @@
##             develop    #1852       +/-   ##
==============================================
+ Coverage      79.99%   98.46%   +18.46%     
+ Complexity       931       20      -911     
==============================================
  Files            203        4      -199     
  Lines           3589       65     -3524     
  Branches         150        0      -150     
==============================================
- Hits            2871       64     -2807     
+ Misses           640        1      -639     
+ Partials          78        0       -78     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@ijusti ijusti added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Apr 26, 2024
@ijusti ijusti merged commit dcebc34 into develop Apr 26, 2024
@ijusti ijusti deleted the snyk-fix-d7b1d1014970d25f587ad46a58d25259 branch April 26, 2024 16:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants