CVE-2020-1729: Permissions bypass in SmallRye
Summary
CVE-2020-1729: Permissions bypass in SmallRye. Affects io.smallrye.config:smallrye-config versions < 1.6.2. Fixed in 1.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SmallRye is a library that provides configuration capabilities for applications running on the Java Virtual Machine (JVM). It is commonly used in Maven projects. SmallRye's API allows developers to access and manipulate configuration settings within their applications. However, a vulnerability has been discovered in SmallRye versions up to 1.6.1 that can potentially allow other code running within the application server to bypass permissions checks and obtain the ClassLoader. This vulnerability poses a moderate threat to data confidentiality.
Vulnerability Detail
The vulnerability in SmallRye's API allows unauthorized code to access the ClassLoader, which can lead to the bypassing of permissions checks. This means that code running within the application server can potentially access sensitive data that it should not have permission to access. The impact of this vulnerability is primarily on data confidentiality. The vulnerability has been assigned the CVE identifier CVE-2020-1729 and has a CVSS score of 4.0.
How To Fix
Minimum fixed version
1.6.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade to the fixed version of SmallRye to mitigate the risk.
Conclusion
In conclusion, the SmallRye library has a vulnerability that allows unauthorized code to bypass permissions checks and potentially access sensitive data. To mitigate this risk, it is important to upgrade to SmallRye version 1.6.2 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.smallrye.config:smallrye-config →
FAQ
SmallRye is a library that provides configuration capabilities for applications running on the Java Virtual Machine (JVM). It is commonly used in Maven projects.
The vulnerability allows unauthorized code to bypass permissions checks and potentially access sensitive data within the application server. The primary impact is on data confidentiality.
To fix this vulnerability, upgrade to SmallRye version 1.6.2 or later. Update the Maven dependency for 'io.smallrye.config:smallrye-config' in your project's pom.xml file.
No, there is no known workaround. Upgrading to the fixed version is necessary to mitigate the risk.
The CVSS score of this vulnerability is 4.0.
