Summary
The JUnit JAR in this repo is vulnerable to CVE-2020-15250, a local information disclosure vulnerability.
Details
An upstream dependency of ours (gdal-async) includes libhdf5. Google Artifact Registry flagged a vulnerability in the resulting Docker image.
It says that the included JUnit JAR was vulnerable to CVE-2020-15250. This JAR should be upgraded to a non-vulnerable version.
The offending JAR lives here.
I believe that all that is necessary is upgrading to Junit 4.13.2. This would mean replacing junit.jar and hamcrest-core.jar. Both are available here.
This issue appears to be related to https://nvd.nist.gov/vuln/detail/CVE-2020-15250.
PoC
I don't have a PoC. I'm opening this to benefit other downstream projects that may also have this vulnerability pop up.
Impact
This is a "local information disclosure vulnerability". I'm not sure if this affects this project, but other downstream projects may be getting false positives alerts as a result of including this vulnerable library.
aphahn Reporter
Summary
The JUnit JAR in this repo is vulnerable to CVE-2020-15250, a local information disclosure vulnerability.
Details
An upstream dependency of ours (
gdal-async) includes libhdf5. Google Artifact Registry flagged a vulnerability in the resulting Docker image.It says that the included JUnit JAR was vulnerable to CVE-2020-15250. This JAR should be upgraded to a non-vulnerable version.
The offending JAR lives here.
I believe that all that is necessary is upgrading to Junit 4.13.2. This would mean replacing
junit.jarandhamcrest-core.jar. Both are available here.This issue appears to be related to https://nvd.nist.gov/vuln/detail/CVE-2020-15250.
PoC
I don't have a PoC. I'm opening this to benefit other downstream projects that may also have this vulnerability pop up.
Impact
This is a "local information disclosure vulnerability". I'm not sure if this affects this project, but other downstream projects may be getting false positives alerts as a result of including this vulnerable library.