DeutschShown in its original language — a full translation is planned for a future version.
JFrog Artifactory: Mehrere Schwachstellen in Drittanbieter-Komponenten
view advisory published 2022-11-20
JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar.
01
describes (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-25857US | high7.5 | — | ||
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. | ||||
| CVE-2022-30635US | high7.5 | — | ||
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains de… | ||||
| CVE-2022-30633US | high7.5 | — | ||
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document in… | ||||
| CVE-2022-28131US | high7.5 | — | ||
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. | ||||
| CVE-2022-1962US | medium5.5 | — | ||
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or dec… | ||||
| CVE-2022-30187US | low1.9OT elevated | — | ||
Azure Storage Library Information Disclosure Vulnerability | ||||
| CVE-2022-25878US | high7.5 | — | ||
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occu… | ||||
| CVE-2022-24823US | medium5.5 | — | ||
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix… | ||||
| CVE-2022-27191US | high7.5OT elevated | — | ||
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. | ||||
| CVE-2021-44906US | critical9.8 | Exploit | ||
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). | ||||
| CVE-2022-0235US | medium6.1 | — | ||
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | ||||
| CVE-2021-3807US | high7.5 | — | ||
ansi-regex is vulnerable to Inefficient Regular Expression Complexity | ||||
| CVE-2021-26291US | critical9.1 | Exploit | ||
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a maliciou… | ||||
| CVE-2020-7789US | medium5.6 | — | ||
This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being pass… | ||||
| CVE-2020-7608US | medium5.3 | — | ||
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload. | ||||
| CVE-2019-20445US | critical9.1 | — | ||
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. | ||||
| CVE-2019-20444US | critical9.1 | — | ||
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interp… | ||||
| CVE-2019-16869US | high7.5 | — | ||
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. | ||||
02
references
External citations — patches, advisories, analysis.
- Atlassian Security Bulletin - November 18 2025external
- HCL Article KB0102172 vom 2022-12-19external
- WID-SEC-W-2022-2133 - CSAF Versionself
- WID-SEC-2022-2133 - Portal Versionself
- JFrog Fixed Security Vulnerabilities vom 2022-11-20external
- JFrog Fixed Security Vulnerabilities - Änderungen vom 2022-11-24external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan