Skip to content

Commit 2b36cdb

Browse files
Bump org.wiremock:wiremock from 3.0.2 to 3.0.3 (#44)
Bumps [org.wiremock:wiremock](https://github.com/wiremock/wiremock) from 3.0.2 to 3.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/wiremock/wiremock/releases">org.wiremock:wiremock's releases</a>.</em></p> <blockquote> <h2>3.0.3 - Security Release</h2> <h2>🔒 Security</h2> <p>This security release addresses the following issues</p> <ul> <li><a href="https://github.com/wiremock/wiremock/security/advisories/GHSA-hq8w-9w8w-pmx7">CVE-2023-41327</a> - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio <ul> <li>Base CVSS Score: 4.6 (<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C&amp;version=3.1">AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C</a>)</li> </ul> </li> <li><a href="https://github.com/wiremock/wiremock/security/advisories/GHSA-pmxq-pj47-j8j4">CVE-2023-41329</a> - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes <ul> <li>Base CVSS Score: 3.9 (<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C&amp;version=3.1">AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C</a>)</li> </ul> </li> </ul> <p><strong>NOTE:</strong> WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by <a href="https://github.com/wiremock/wiremock/security/advisories/GHSA-676j-xrv3-73vc">CVE-2023-39967 - Overall CVSS Score 8.6</a> - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to <a href="https://www.wiremock.io/product">WireMock Cloud</a> which is available as SaaS and private beta for on-premises deployments</p> <h2>🔗 Related releases</h2> <ul> <li><a href="https://github.com/wiremock/wiremock-docker/releases/tag/3.0.3-1">WireMock Docker 3.0.3-1</a> - Docker Image with the Patch</li> <li><a href="https://github.com/wiremock/wiremock/releases/tag/2.35.1">WireMock 2.35.1</a> / <a href="https://github.com/wiremock/wiremock-docker/releases/tag/2.35.1-1">WireMock Docker 2.35.1-1</a> - Backport to WireMock 2.x</li> <li><a href="https://github.com/wiremock/python-wiremock/releases/tag/2.6.1">Python WireMock 2.6.1</a> - Python library that bundles the WireMock JAR file</li> <li>NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk</li> </ul> <h2>Credits</h2> <p><a href="https://github.com/W0rty"><code>@​W0rty</code></a>, <a href="https://github.com/numacanedo"><code>@​numacanedo</code></a>, <a href="https://github.com/Mahoney"><code>@​Mahoney</code></a>, <a href="https://github.com/tomakehurst"><code>@​tomakehurst</code></a>, <a href="https://github.com/oleg-nenashev"><code>@​oleg-nenashev</code></a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/wiremock/wiremock/commit/7a5126498182fd1c5036128244ede631e790804e"><code>7a51264</code></a> Bumped patch version</li> <li><a href="https://github.com/wiremock/wiremock/commit/0f72091c92a463424e39dc3c755afab517dc9839"><code>0f72091</code></a> Stop NetworkAddressRules doing DNS lookups</li> <li><a href="https://github.com/wiremock/wiremock/commit/984e79f2f6163f42fe16b5224573da341c0fd9f0"><code>984e79f</code></a> Make NetworkAddressRulesAdheringDnsResolver testable</li> <li><a href="https://github.com/wiremock/wiremock/commit/92d77937bee88c8d730143185f9f718bc24feeb6"><code>92d7793</code></a> Applied DNS resolver enforcement to webhooks extension</li> <li><a href="https://github.com/wiremock/wiremock/commit/027ddafc38a1048d6bd64d896b07ee35b0268894"><code>027ddaf</code></a> Moved enforcement of network address rules to Apache client DNS resolver to a...</li> <li>See full diff in <a href="https://github.com/wiremock/wiremock/compare/3.0.2...3.0.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.wiremock:wiremock&package-manager=gradle&previous-version=3.0.2&new-version=3.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 parent 8572da4 commit 2b36cdb

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

build.gradle

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ wrapper {
2424
project.ext {
2525
baseArtifact = 'wiremock-state-extension'
2626
versions = [
27-
wiremock : '3.0.2',
27+
wiremock : '3.0.3',
2828
caffeine : '3.1.8',
2929
handlebars: '4.3.1',
3030
junit : '5.10.0',

0 commit comments

Comments
 (0)