Homepage

com.facebook.presto:presto-client@0.123 vulnerabilities

  • latest version

    0.293

  • latest non vulnerable version

    0.293

  • first published

    11 years ago

  • latest version published

    7 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the com.facebook.presto:presto-client package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Server-side Request Forgery (SSRF)

    com.facebook.presto:presto-client is a Presto Client

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the nextUri parameter in the advance function. Presto JDBC can be affected by this vulnerability when connecting a remote Presto server. An attacker can view sensitive information from highly sensitive internal servers or perform a local port scan by modifying the nextUri parameter to an internal server in response content that the client will request next.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade com.facebook.presto:presto-client to version 0.286 or higher.

    [,0.286)
    • H
    Server-side Request Forgery (SSRF)

    com.facebook.presto:presto-client is a Presto Client

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the StatementClientV1 function. Presto JDBC can be affected by this vulnerability when connecting a remote Presto server. An attacker can view sensitive information from highly sensitive internal servers or perform a local port scan by constructing a redirect response that the client will follow.

    Mitigation:

    This vulnerability can be mitigated by disabling the redirect or adding a JDBC parameter such as allowRedirect.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade com.facebook.presto:presto-client to version 0.286 or higher.

    [,0.286)
    Go back to all versions of this package