Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.github.karlatemp:unsafe-accessor

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9MavenPublished

    UnsafeAccessor 1.4.0 until 1.7.0 has no security checking for UnsafeAccess.getInstance()

    CVE-2022-31139 · GHSA-cr6p-23cf-w9g9

    Affected
    • Maven io.github.karlatemp:unsafe-accessor >= 1.4.0, < 1.7.0
    Fixed in
    1.7.0· Vendor fix available
    Issue
    Affected versions have no limit to using unsafe-accessor. Can be ignored if SecurityCheck.AccessLimiter not setup Details If UA was loaded as a named module, the internal data of UA will be protected by JVM and others can only access UA via UA's standard api. Main application can setup SecurityCheck.AccessLimiter for UA to limit accesses to UA. Untrusted code can access UA without lmitation in affected versions even UA was loaded as a named module. References The commit to fix

    Recommended action: Upgrade to 1.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →