Homepage
About Snyk

de.tum.in.ase:artemis-java-test-sandbox@1.4.2 vulnerabilities

  • latest version

    1.13.0

  • latest non vulnerable version

    1.13.0

  • first published

    4 years ago

  • latest version published

    9 months ago

  • licenses detected

  • package manager

    View on Maven Repository
Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the de.tum.in.ase:artemis-java-test-sandbox package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Access Control

Affected versions of this package are vulnerable to Improper Access Control due to missing checkLink(String) override in the SecurityManager, libraries can be loaded and executed by using System.load(String) or System.loadLibrary​(String).

private static native void start(List<String> args);

public static void main(String[] args) {
  System.load(new File("path_to_lib.so").getAbsolutePath());
  start(List.of(args));
}

How to fix Improper Access Control?

Upgrade de.tum.in.ase:artemis-java-test-sandbox to version 1.11.2 or higher.

[,1.11.2)
  • H
Improper Isolation or Compartmentalization

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization which allows code that gets automatically tested to run arbitrary code in the container or on the machine of an assessor in case of manual correction.

How to fix Improper Isolation or Compartmentalization?

Upgrade de.tum.in.ase:artemis-java-test-sandbox to version 1.8.0 or higher.

[,1.8.0)
  • H
Arbitrary Code Execution

Affected versions of this package are vulnerable to Arbitrary Code Execution by allowing an attacker to create special subclasses of InvocationTargetException that escape the exception sanitization. This is because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and that in turn allows disabling Ares and having full control over the system.

How to fix Arbitrary Code Execution?

Upgrade de.tum.in.ase:artemis-java-test-sandbox to version 1.7.6 or higher.

[,1.7.6)
Go back to all versions of this package