Dependency org.apache.httpcomponents:httpclient, leading to CVE problem #225
Description
Hi, in resttemplate/, there is a dependency **org.apache.httpcomponents:httpclient:4.5.8
** that calls the risk method.
The scope of this CVE affected version is [,4.5.13)
After further analysis, in this project, the main Api called is org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost
Risk method repair link : GitHub
CVE Bug Invocation Path--
Path Length : 9
guru.springframework.resttemplate.client.EmployeeRestClient: getAsJsonNode(long)Lcom.fasterxml.jackson.databind.JsonNode; .m2/repository/org/springframework/spring-core/5.1.6.RELEASE/spring-core-5.1.6.RELEASE.jar
org.springframework.web.client.RestTemplate: getForObject(java.lang.String,java.lang.Class,java.lang.Object[])Ljava.lang.Object; .m2/repository/javax/validation/validation-api/2.0.1.Final/validation-api-2.0.1.Final.jar
org.springframework.web.client.RestTemplate: execute(java.lang.String,org.springframework.http.HttpMethod,org.springframework.web.client.RequestCallback,org.springframework.web.client.ResponseExtractor,java.lang.Object[])Ljava.lang.Object; .m2/repository/javax/validation/validation-api/2.0.1.Final/validation-api-2.0.1.Final.jar
org.springframework.web.client.RestTemplate: doExecute(java.net.URI,org.springframework.http.HttpMethod,org.springframework.web.client.RequestCallback,org.springframework.web.client.ResponseExtractor)Ljava.lang.Object; .m2/repository/javax/validation/validation-api/2.0.1.Final/validation-api-2.0.1.Final.jar
org.springframework.http.client.AbstractClientHttpRequest: execute()Lorg.springframework.http.client.ClientHttpResponse; .m2/repository/javax/validation/validation-api/2.0.1.Final/validation-api-2.0.1.Final.jar
org.springframework.http.client.HttpComponentsStreamingClientHttpRequest: executeInternal(org.springframework.http.HttpHeaders)Lorg.springframework.http.client.ClientHttpResponse; .m2/repository/javax/validation/validation-api/2.0.1.Final/validation-api-2.0.1.Final.jar
org.apache.http.impl.client.DecompressingHttpClient: execute(org.apache.http.client.methods.HttpUriRequest,org.apache.http.protocol.HttpContext)Lorg.apache.http.HttpResponse; .m2/repository/org/projectlombok/lombok/1.18.6/lombok-1.18.6.jar
org.apache.http.impl.client.DecompressingHttpClient: getHttpHost(org.apache.http.client.methods.HttpUriRequest)Lorg.apache.http.HttpHost; .m2/repository/org/projectlombok/lombok/1.18.6/lombok-1.18.6.jar
org.apache.http.client.utils.URIUtils: extractHost(java.net.URI)Lorg.apache.http.HttpHost;
Dependency tree--
[INFO] guru.springframework:resttemplate:jar:0.0.1-SNAPSHOT
[INFO] +- org.springframework.boot:spring-boot-starter-web:jar:2.1.4.RELEASE:compile
[INFO] | +- org.springframework.boot:spring-boot-starter:jar:2.1.4.RELEASE:compile
[INFO] | | +- org.springframework.boot:spring-boot:jar:2.1.4.RELEASE:compile
[INFO] | | +- org.springframework.boot:spring-boot-autoconfigure:jar:2.1.4.RELEASE:compile
[INFO] | | +- org.springframework.boot:spring-boot-starter-logging:jar:2.1.4.RELEASE:compile
[INFO] | | | +- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] | | | | \- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] | | | +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.11.2:compile
[INFO] | | | | \- org.apache.logging.log4j:log4j-api:jar:2.11.2:compile
[INFO] | | | \- org.slf4j:jul-to-slf4j:jar:1.7.26:compile
[INFO] | | +- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] | | \- org.yaml:snakeyaml:jar:1.23:runtime
[INFO] | +- org.springframework.boot:spring-boot-starter-json:jar:2.1.4.RELEASE:compile
[INFO] | | +- com.fasterxml.jackson.core:jackson-databind:jar:2.9.8:compile
[INFO] | | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.9.0:compile
[INFO] | | | \- com.fasterxml.jackson.core:jackson-core:jar:2.9.8:compile
[INFO] | | +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.9.8:compile
[INFO] | | +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.9.8:compile
[INFO] | | \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.9.8:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-tomcat:jar:2.1.4.RELEASE:compile
[INFO] | | +- org.apache.tomcat.embed:tomcat-embed-core:jar:9.0.17:compile
[INFO] | | +- org.apache.tomcat.embed:tomcat-embed-el:jar:9.0.17:compile
[INFO] | | \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:9.0.17:compile
[INFO] | +- org.hibernate.validator:hibernate-validator:jar:6.0.16.Final:compile
[INFO] | | +- javax.validation:validation-api:jar:2.0.1.Final:compile
[INFO] | | +- org.jboss.logging:jboss-logging:jar:3.3.2.Final:compile
[INFO] | | \- com.fasterxml:classmate:jar:1.4.0:compile
[INFO] | +- org.springframework:spring-web:jar:5.1.6.RELEASE:compile
[INFO] | | \- org.springframework:spring-beans:jar:5.1.6.RELEASE:compile
[INFO] | \- org.springframework:spring-webmvc:jar:5.1.6.RELEASE:compile
[INFO] | +- org.springframework:spring-aop:jar:5.1.6.RELEASE:compile
[INFO] | +- org.springframework:spring-context:jar:5.1.6.RELEASE:compile
[INFO] | \- org.springframework:spring-expression:jar:5.1.6.RELEASE:compile
[INFO] +- org.apache.httpcomponents:httpclient:jar:4.5.8:compile
[INFO] | +- org.apache.httpcomponents:httpcore:jar:4.4.11:compile
[INFO] | \- commons-codec:commons-codec:jar:1.11:compile
[INFO] +- org.springframework.boot:spring-boot-starter-test:jar:2.1.4.RELEASE:test
[INFO] | +- org.springframework.boot:spring-boot-test:jar:2.1.4.RELEASE:test
[INFO] | +- org.springframework.boot:spring-boot-test-autoconfigure:jar:2.1.4.RELEASE:test
[INFO] | +- com.jayway.jsonpath:json-path:jar:2.4.0:test
[INFO] | | +- net.minidev:json-smart:jar:2.3:test
[INFO] | | | \- net.minidev:accessors-smart:jar:1.2:test
[INFO] | | | \- org.ow2.asm:asm:jar:5.0.4:test
[INFO] | | \- org.slf4j:slf4j-api:jar:1.7.26:compile
[INFO] | +- junit:junit:jar:4.12:test
[INFO] | +- org.assertj:assertj-core:jar:3.11.1:test
[INFO] | +- org.mockito:mockito-core:jar:2.23.4:test
[INFO] | | +- net.bytebuddy:byte-buddy:jar:1.9.12:test
[INFO] | | +- net.bytebuddy:byte-buddy-agent:jar:1.9.12:test
[INFO] | | \- org.objenesis:objenesis:jar:2.6:test
[INFO] | +- org.hamcrest:hamcrest-core:jar:1.3:test
[INFO] | +- org.hamcrest:hamcrest-library:jar:1.3:test
[INFO] | +- org.skyscreamer:jsonassert:jar:1.5.0:test
[INFO] | | \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
[INFO] | +- org.springframework:spring-core:jar:5.1.6.RELEASE:compile
[INFO] | | \- org.springframework:spring-jcl:jar:5.1.6.RELEASE:compile
[INFO] | +- org.springframework:spring-test:jar:5.1.6.RELEASE:test
[INFO] | \- org.xmlunit:xmlunit-core:jar:2.6.2:test
[INFO] | \- javax.xml.bind:jaxb-api:jar:2.3.1:test
[INFO] | \- javax.activation:javax.activation-api:jar:1.2.0:test
[INFO] +- org.junit.jupiter:junit-jupiter:jar:5.5.0-M1:test
[INFO] | +- org.junit.jupiter:junit-jupiter-api:jar:5.3.2:test
[INFO] | | +- org.apiguardian:apiguardian-api:jar:1.0.0:test
[INFO] | | +- org.opentest4j:opentest4j:jar:1.1.1:test
[INFO] | | \- org.junit.platform:junit-platform-commons:jar:1.3.2:test
[INFO] | +- org.junit.jupiter:junit-jupiter-params:jar:5.3.2:test
[INFO] | \- org.junit.jupiter:junit-jupiter-engine:jar:5.3.2:test
[INFO] | \- org.junit.platform:junit-platform-engine:jar:1.3.2:test
[INFO] \- org.projectlombok:lombok:jar:1.18.6:compile (optional)
Suggested solutions:
Update dependency(spring-boot) version
Thank you very much.