Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.jooby:jooby

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    path traversal in Jooby

    CVE-2020-7647 · GHSA-px9h-x66r-8mpc

    Affected
    • Maven io.jooby:jooby < 2.8.2
    Fixed in
    2.8.2· Vendor fix available
    Issue
    Impact Access to sensitive information available from classpath. Patches Patched version: 1.6.7 and 2.8.2 Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009 Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? References Latest 1.x version: 1.6.6 Arbitrary class path resource access 1 When sharing a File System directory as in: The class path is also searched for the file (org.jooby.handlers.AssetHandler.loader): jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub If we send /static/WEB-INF/web.xml it will fail to load it from the file system but will go into classloader.getResource(name) where name equals /WEB-INF/web.xml so will succeed and return the requested file. This way we can get any configuration file or even the application class files If assets are configured for a certain…

    Recommended action: Upgrade to 2.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →