Security Exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer
Summary
OSV-2024-117: Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer. Affects docker-client versions >= 9a7c3b4994be9a55988f821f7177029201ff6aef. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The docker-client package is an open-source library used for interacting with the Docker API. It provides a convenient way to manage Docker containers, images, and other resources. This vulnerability affects the TokenBuffer class in the com.fasterxml.jackson.databind.util package, which is used for buffering JSON tokens during serialization and deserialization.
Vulnerability Detail
The vulnerability is a security exception that occurs in the CharsetEncoder class when initializing a CESU_8 encoder. This can lead to a crash or other security issues. The vulnerability was reported through the OSS-Fuzz project and has a low severity rating. More details can be found in the OSS-Fuzz report: [link].
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the docker-client package is affected by a security exception vulnerability in the TokenBuffer class. It is recommended to update to a secure version of the package or use a dependency management tool to automatically update. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for docker-client →
FAQ
The impact of this vulnerability can vary depending on the specific usage of the docker-client package. It could potentially lead to crashes or security breaches in applications that use the affected functionality.
You can use the Vulert Playground at [link] to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
There is no known exploit mentioned in the vulnerability report. However, it is always recommended to promptly update to a secure version to mitigate any potential risks.
The recommended mitigation is to update the docker-client package to a secure version. Additionally, following secure coding practices and regularly updating dependencies can help reduce the overall risk of vulnerabilities.
You can find more information about this vulnerability in the OSS-Fuzz report linked in the vulnerability details section.
References
Related vulnerabilities
Recent vulnerabilities recorded for docker-client.
