org.apache.uima:uimaj-adapter-vinci 2.3.1 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.uima:uimaj-adapter-vinci package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability	Vulnerable Version
H Deserialization of Untrusted Data org.apache.uima:uimaj-adapter-vinci is a that provides the capability to connect to a remote analysis engine, using the Vinci protocol. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the `CasIOUtils` class. An attacker can execute arbitrary code by deserializing unverified Java objects. This is only exploitable if the user or developer has actively chosen to start a service that is remotely accessible, such as Vinci, or if they use the `CasIOUtils` in their own applications and services to parse untrusted serialized CAS data. How to fix Deserialization of Untrusted Data? Upgrade `org.apache.uima:uimaj-adapter-vinci` to version 3.5.0 or higher.	[,3.5.0)
M XML External Entity (XXE) Injection org.apache.uima:uimaj-adapter-vinci is a that provides the capability to connect to a remote analysis engine, using the Vinci protocol. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. As part of its configuration and operation, UIMA may read XML from various sources. An attacker may craft malicious XML file which could inadvertently disclose local files or other internal content. How to fix XML External Entity (XXE) Injection? Upgrade `org.apache.uima:uimaj-adapter-vinci` to version 2.10.2, 3.0.0-beta or higher.	[,2.10.2)[3.0.0-alpha,3.0.0-beta)

Vulnerability

Vulnerable Version

Deserialization of Untrusted Data

org.apache.uima:uimaj-adapter-vinci is a that provides the capability to connect to a remote analysis engine, using the Vinci protocol.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the CasIOUtils class. An attacker can execute arbitrary code by deserializing unverified Java objects. This is only exploitable if the user or developer has actively chosen to start a service that is remotely accessible, such as Vinci, or if they use the CasIOUtils in their own applications and services to parse untrusted serialized CAS data.

How to fix Deserialization of Untrusted Data?

Upgrade org.apache.uima:uimaj-adapter-vinci to version 3.5.0 or higher.

[,3.5.0)

XML External Entity (XXE) Injection

org.apache.uima:uimaj-adapter-vinci is a that provides the capability to connect to a remote analysis engine, using the Vinci protocol.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. As part of its configuration and operation, UIMA may read XML from various sources. An attacker may craft malicious XML file which could inadvertently disclose local files or other internal content.

How to fix XML External Entity (XXE) Injection?

Upgrade org.apache.uima:uimaj-adapter-vinci to version 2.10.2, 3.0.0-beta or higher.

[,2.10.2)[3.0.0-alpha,3.0.0-beta)

org.apache.uima:uimaj-adapter-vinci@2.3.1 vulnerabilities

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

How to fix?