com.cedarpolicy:cedar-java 4.2.3

Direct Vulnerabilities

Known vulnerabilities in the com.cedarpolicy:cedar-java package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Arbitrary Code Injection Affected versions of this package are vulnerable to Arbitrary Code Injection via the `toCedarExpr` method, which does not escape special characters when converting values to source code. An attacker can inject arbitrary expressions by supplying specially crafted input, potentially altering authorization logic or bypassing intended restrictions. This is only exploitable if user-controlled input is used to build policy text at runtime through `toCedarExpr`. How to fix Arbitrary Code Injection? Upgrade `com.cedarpolicy:cedar-java` to version 2.3.6, 3.4.1, 4.9.0 or higher.	[,2.3.6)[3.1.2,3.4.1)[4.0.0,4.9.0)
H Access of Resource Using Incompatible Type ('Type Confusion') Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') through improper handling of reserved keys in the JSON protocol when serializing `CedarMap`. An attacker can cause unauthorized access or manipulation of data by supplying specially crafted keys that are interpreted incorrectly across the Java-Rust FFI boundary. This is only exploitable if the integrating service constructs a `CedarMap` from attacker-controlled keys and a policy references that value in a when/unless clause. How to fix Access of Resource Using Incompatible Type ('Type Confusion')? Upgrade `com.cedarpolicy:cedar-java` to version 2.3.6, 3.4.1, 4.9.0 or higher.	[,2.3.6)[3.1.2,3.4.1)[4.0.0,4.9.0)

Vulnerability

Vulnerable Version

Arbitrary Code Injection

Affected versions of this package are vulnerable to Arbitrary Code Injection via the toCedarExpr method, which does not escape special characters when converting values to source code. An attacker can inject arbitrary expressions by supplying specially crafted input, potentially altering authorization logic or bypassing intended restrictions. This is only exploitable if user-controlled input is used to build policy text at runtime through toCedarExpr.

How to fix Arbitrary Code Injection?

Upgrade com.cedarpolicy:cedar-java to version 2.3.6, 3.4.1, 4.9.0 or higher.

[,2.3.6)[3.1.2,3.4.1)[4.0.0,4.9.0)

Access of Resource Using Incompatible Type ('Type Confusion')

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') through improper handling of reserved keys in the JSON protocol when serializing CedarMap. An attacker can cause unauthorized access or manipulation of data by supplying specially crafted keys that are interpreted incorrectly across the Java-Rust FFI boundary. This is only exploitable if the integrating service constructs a CedarMap from attacker-controlled keys and a policy references that value in a when/unless clause.

How to fix Access of Resource Using Incompatible Type ('Type Confusion')?

Upgrade com.cedarpolicy:cedar-java to version 2.3.6, 3.4.1, 4.9.0 or higher.

[,2.3.6)[3.1.2,3.4.1)[4.0.0,4.9.0)

com.cedarpolicy:cedar-java@4.2.3

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically