temporalio / temporalio/sdk-java
kotlin-klib-commonizer-embeddable-1.5.32.jar: 1 vulnerabilities (highest severity is: 5.3)
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 433
- Forks
- 249
- Avg merge
- 5d 6h
- Merged PRs (30d)
- 26
Description
Vulnerable Library - kotlin-klib-commonizer-embeddable-1.5.32.jar
Path to dependency file: /temporal-kotlin/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jetbrains.kotlin/kotlin-stdlib/1.5.32/a1f8a73f899b85e6eb4337dff7e81b8b914bd2c9/kotlin-stdlib-1.5.32.jar
Found in HEAD commit: f389bd8e9cd8956213466e705d5e2a36978aea65
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (kotlin-klib-commonizer-embeddable version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2022-24329 |  Medium |
5.3 | kotlin-stdlib-1.5.32.jar | Transitive | 1.6.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-24329
Vulnerable Library - kotlin-stdlib-1.5.32.jar
Kotlin Standard Library for JVM
Library home page: https://kotlinlang.org/
Path to dependency file: /temporal-kotlin/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jetbrains.kotlin/kotlin-stdlib/1.5.32/a1f8a73f899b85e6eb4337dff7e81b8b914bd2c9/kotlin-stdlib-1.5.32.jar
Dependency Hierarchy:
- kotlin-klib-commonizer-embeddable-1.5.32.jar (Root Library)
- ❌ kotlin-stdlib-1.5.32.jar (Vulnerable Library)
Found in HEAD commit: f389bd8e9cd8956213466e705d5e2a36978aea65
Found in base branch: master
Vulnerability Details
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
Publish Date: 2022-02-25
URL: CVE-2022-24329
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-2qp4-g3q3-f92w
Release Date: 2022-02-25
Fix Resolution (org.jetbrains.kotlin:kotlin-stdlib): 1.6.0-M1
Direct dependency fix Resolution (org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable): 1.6.0
⛑️ Automatic Remediation will be attempted for this issue.
:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in /temporal-kotlin/build.gradle and inspect the dependency path for kotlin-klib-commonizer-embeddable and kotlin-stdlib. Upgrade the direct dependency to 1.6.0, then run the project's available Gradle checks and vulnerability scan to confirm CVE-2022-24329 is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100