com.mchange:mchange-commons-java 0.2.1-RELEASE

Direct Vulnerabilities

Known vulnerabilities in the com.mchange:mchange-commons-java package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via unsafe JavaBean materialization in `com.mchange.v2.naming.JavaBeanObjectFactory`. An attacker can trigger arbitrary class construction and property initialization by supplying a malicious JNDI `Reference` whose class name and bean properties are resolved by the factory. This lets an attacker instantiate unsafe JavaBeans and drive attacker-controlled initialization side effects from within the application’s lookup path. In affected deployments, that can lead to unexpected network access or other malicious behavior when the application dereferences untrusted JNDI data. How to fix Deserialization of Untrusted Data? Upgrade `com.mchange:mchange-commons-java` to version 0.6.0 or higher.	[,0.6.0)
H Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the `factoryClassLocation` function. An attacker can achieve arbitrary code execution by provoking the application to read a maliciously crafted `javax.naming.Reference` or serialized object, resulting in the download and execution of malicious code. How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')? Upgrade `com.mchange:mchange-commons-java` to version 0.4.0 or higher.	[,0.4.0)

Vulnerability

Vulnerable Version

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via unsafe JavaBean materialization in com.mchange.v2.naming.JavaBeanObjectFactory. An attacker can trigger arbitrary class construction and property initialization by supplying a malicious JNDI Reference whose class name and bean properties are resolved by the factory. This lets an attacker instantiate unsafe JavaBeans and drive attacker-controlled initialization side effects from within the application’s lookup path. In affected deployments, that can lead to unexpected network access or other malicious behavior when the application dereferences untrusted JNDI data.

How to fix Deserialization of Untrusted Data?

Upgrade com.mchange:mchange-commons-java to version 0.6.0 or higher.

[,0.6.0)

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the factoryClassLocation function. An attacker can achieve arbitrary code execution by provoking the application to read a maliciously crafted javax.naming.Reference or serialized object, resulting in the download and execution of malicious code.

How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')?

Upgrade com.mchange:mchange-commons-java to version 0.4.0 or higher.

[,0.4.0)

com.mchange:mchange-commons-java@0.2.1-RELEASE

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically