-
Notifications
You must be signed in to change notification settings - Fork 6
Commit 2b36cdb
authored
Bump org.wiremock:wiremock from 3.0.2 to 3.0.3 (#44)
Bumps [org.wiremock:wiremock](https://github.com/wiremock/wiremock) from
3.0.2 to 3.0.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/wiremock/wiremock/releases">org.wiremock:wiremock's
releases</a>.</em></p>
<blockquote>
<h2>3.0.3 - Security Release</h2>
<h2>🔒 Security</h2>
<p>This security release addresses the following issues</p>
<ul>
<li><a
href="https://github.com/wiremock/wiremock/security/advisories/GHSA-hq8w-9w8w-pmx7">CVE-2023-41327</a>
- Controlled SSRF through URL in the WireMock Webhooks Extension and
WireMock Studio
<ul>
<li>Base CVSS Score: 4.6 (<a
href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C&version=3.1">AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C</a>)</li>
</ul>
</li>
<li><a
href="https://github.com/wiremock/wiremock/security/advisories/GHSA-pmxq-pj47-j8j4">CVE-2023-41329</a>
- Domain restrictions bypass via DNS Rebinding in WireMock and WireMock
Studio webhooks, proxy and recorder modes
<ul>
<li>Base CVSS Score: 3.9 (<a
href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C&version=3.1">AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C</a>)</li>
</ul>
</li>
</ul>
<p><strong>NOTE:</strong> WireMock Studio, a proprietary distribution
discontinued in 2022, is also affected by those issues and also affected
by <a
href="https://github.com/wiremock/wiremock/security/advisories/GHSA-676j-xrv3-73vc">CVE-2023-39967
- Overall CVSS Score 8.6</a> - “Controlled and full-read SSRF through
URL parameter when testing a request, webhooks and proxy mode”. The
fixes will not be provided. The vendor recommends migrating to <a
href="https://www.wiremock.io/product">WireMock Cloud</a> which is
available as SaaS and private beta for on-premises deployments</p>
<h2>🔗 Related releases</h2>
<ul>
<li><a
href="https://github.com/wiremock/wiremock-docker/releases/tag/3.0.3-1">WireMock
Docker 3.0.3-1</a> - Docker Image with the Patch</li>
<li><a
href="https://github.com/wiremock/wiremock/releases/tag/2.35.1">WireMock
2.35.1</a> / <a
href="https://github.com/wiremock/wiremock-docker/releases/tag/2.35.1-1">WireMock
Docker 2.35.1-1</a> - Backport to WireMock 2.x</li>
<li><a
href="https://github.com/wiremock/python-wiremock/releases/tag/2.6.1">Python
WireMock 2.6.1</a> - Python library that bundles the WireMock JAR
file</li>
<li>NOTE: Other distributions like Testcontainers modules or Helm chart
need explicit version declaration, and hence a user action is needed to
update the dependencies should they be considered a risk</li>
</ul>
<h2>Credits</h2>
<p><a href="https://github.com/W0rty"><code>@W0rty</code></a>, <a
href="https://github.com/numacanedo"><code>@numacanedo</code></a>, <a
href="https://github.com/Mahoney"><code>@Mahoney</code></a>, <a
href="https://github.com/tomakehurst"><code>@tomakehurst</code></a>, <a
href="https://github.com/oleg-nenashev"><code>@oleg-nenashev</code></a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/wiremock/wiremock/commit/7a5126498182fd1c5036128244ede631e790804e"><code>7a51264</code></a>
Bumped patch version</li>
<li><a
href="https://github.com/wiremock/wiremock/commit/0f72091c92a463424e39dc3c755afab517dc9839"><code>0f72091</code></a>
Stop NetworkAddressRules doing DNS lookups</li>
<li><a
href="https://github.com/wiremock/wiremock/commit/984e79f2f6163f42fe16b5224573da341c0fd9f0"><code>984e79f</code></a>
Make NetworkAddressRulesAdheringDnsResolver testable</li>
<li><a
href="https://github.com/wiremock/wiremock/commit/92d77937bee88c8d730143185f9f718bc24feeb6"><code>92d7793</code></a>
Applied DNS resolver enforcement to webhooks extension</li>
<li><a
href="https://github.com/wiremock/wiremock/commit/027ddafc38a1048d6bd64d896b07ee35b0268894"><code>027ddaf</code></a>
Moved enforcement of network address rules to Apache client DNS resolver
to a...</li>
<li>See full diff in <a
href="https://github.com/wiremock/wiremock/compare/3.0.2...3.0.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent 8572da4 commit 2b36cdbCopy full SHA for 2b36cdb
File tree
Expand file treeCollapse file tree
1 file changed
+1
-1
lines changedFilter options
Expand file treeCollapse file tree
1 file changed
+1
-1
lines changedCollapse file: build.gradle
+1-1Lines changed: 1 addition & 1 deletion
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
24 | 24 |
| |
25 | 25 |
| |
26 | 26 |
| |
27 |
| - | |
| 27 | + | |
28 | 28 |
| |
29 | 29 |
| |
30 | 30 |
| |
|
0 commit comments