erroneo.us
Search all guides⌘K

Security Digest · Critical advisory (no CVE assigned)

GHSA-2gh6-wc3m-g37f: hermes-management is vulnerable to RCE due to Apache commons-jxpath

Impact hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.

CVSS 9.3 Critical GitHub-reviewed · critical

Published By erroneo.us Security DeskSeen in the digest for Sep 17, 2024

Should you act?

  • Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

EcosystemPackageVulnerableFirst fixed
Mavenpl.allegro.tech.hermes:hermes-management>= 0.8.2, < 2.2.92.2.9

Details

Impact hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.

Patches Upgrade Hermes to at least hermes-2.2.9

References https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/

CVSS: 9.3 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Sources and references

  1. GitHub Advisory GHSA-2gh6-wc3m-g37f github.com
  2. github.com github.com
  3. github.com github.com
  4. hackinglab.cz hackinglab.cz
  5. github.com github.com

Critical Maven advisories · Today’s Security Digest