org.openidentityplatform.openam:openam-push-notification@16.0.6
latest version
16.1.2
latest non vulnerable version
first published
5 years ago
latest version published
11 days ago
licenses detected
- (CC-BY-NC-ND-3.0 OR CDDL-1.0)[14.5.2,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.openidentityplatform.openam:openam-push-notification package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the SNS callback process. An attacker can trigger class loading and object construction with attacker-controlled data by sending specially crafted SNS callbacks after the in-memory dispatcher entry for a message identifier has expired, leading to potential process execution, file writes, or denial of service depending on the deployment's classpath and environment. This is only exploitable if the Push Notification Service with SNS callbacks is enabled and a low-privileged user can initiate Push Registration and obtain the necessary messageId, shared secret, and challenge. How to fix Deserialization of Untrusted Data? Upgrade | [,16.1.1) |