Security Exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer
Summary
OSV-2023-942: Security exception in com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util.TokenBuffer. Affects docker-client versions >= 9a7c3b4994be9a55988f821f7177029201ff6aef. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The docker-client package is an open-source library used for interacting with the Docker API. It provides a set of Java classes and methods to manage Docker containers, images, and other resources. This vulnerability affects the TokenBuffer class in the com.spotify.docker.client.shaded.com.fasterxml.jackson.databind.util package.
Vulnerability Detail
The vulnerability is a security exception that occurs in the TokenBuffer class when encoding arrays using the CESU-8 encoding. This can lead to a crash or unexpected behavior in applications that use the docker-client library. The issue was reported through the OSS-Fuzz project and has a low severity rating. More details can be found in the OSS-Fuzz report: [link to report].
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the docker-client library is affected by a security exception vulnerability in the TokenBuffer class. Developers should update their library version to include the fix and ensure the security of their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for docker-client →
FAQ
The impact of this vulnerability can vary depending on how the docker-client library is used in an application. In some cases, it may lead to a crash or unexpected behavior, potentially affecting the availability or integrity of the application.
There is no known exploit available for this vulnerability at the moment. However, it is always recommended to apply security patches and updates as soon as they are available to mitigate any potential risks.
No, only versions prior to the commit 9a7c3b4994be9a55988f821f7177029201ff6aef are affected by this vulnerability. Developers should update to a fixed version to ensure their applications are not vulnerable.
The vulnerability itself does not provide remote code execution capabilities. However, if an application using the docker-client library is exposed to untrusted input or accessible from the internet, it may be possible for an attacker to exploit other vulnerabilities in combination with this one.
More information about this vulnerability can be found in the OSS-Fuzz report linked in the vulnerability details section.
References
Related vulnerabilities
Recent vulnerabilities recorded for docker-client.
