CVE-2019-19899: Pebble Templates Improper Input Validation vulnerability in io.pebbletemplates:pebble-project
Summary
CVE-2019-19899: Pebble Templates Improper Input Validation vulnerability. Affects io.pebbletemplates:pebble-project versions < 3.1.4. Fixed in 3.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pebble Templates is a Java-based templating engine used for generating dynamic web content. It provides a simple and efficient way to create HTML, XML, and other text-based templates. The vulnerability affects the io.pebbletemplates:pebble-project package, specifically versions prior to 3.1.4.
Vulnerability Detail
The vulnerability in Pebble Templates allows attackers to bypass a protection mechanism that is intended to block access to instances of java.lang.Class. This is possible because the getClass method is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature. Exploiting this vulnerability could lead to unauthorized access to sensitive data or the execution of arbitrary code.
How To Fix
Minimum fixed version
3.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version to mitigate the risk of exploitation.
Conclusion
The Pebble Templates Improper Input Validation vulnerability in the io.pebbletemplates:pebble-project package can be mitigated by upgrading to version 3.1.4 or later. It is important to promptly apply this fix to prevent potential unauthorized access or code execution. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.pebbletemplates:pebble-project →
FAQ
Pebble Templates is a Java-based templating engine used for generating dynamic web content. It provides a simple and efficient way to create HTML, XML, and other text-based templates.
Exploiting this vulnerability could allow attackers to bypass a protection mechanism and potentially gain unauthorized access to sensitive data or execute arbitrary code.
To fix this vulnerability, it is recommended to upgrade the io.pebbletemplates:pebble-project package to version 3.1.4 or later.
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version to mitigate the risk of exploitation.
You can find more information about this vulnerability in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-83m8-7hj8-ff5w/GHSA-83m8-7hj8-ff5w.json
