UNCLASSIFIED - NO CUI

Skip to content

chore(findings): kinetica/pathfinder/flightplan_forwarder

Summary

kinetica/pathfinder/flightplan_forwarder has 72 new findings discovered during continuous monitoring.

id source severity package
GHSA-mc84-pj99-q6hh Anchore CVE High commons-compress-1.20
GHSA-crv7-7245-f45f Anchore CVE High commons-compress-1.20
GHSA-53jx-vvf9-4x38 Anchore CVE Medium vertx-web-4.3.3
GHSA-7hfm-57qf-j43q Anchore CVE High commons-compress-1.20
GHSA-rgv9-q543-rqg4 Anchore CVE High jackson-databind-2.13.2.1
GHSA-jjjh-jjxp-wpff Anchore CVE High jackson-databind-2.13.2.1
GHSA-xqfj-vm6h-2x34 Anchore CVE High commons-compress-1.20
GHSA-p26g-97m4-6q7c Anchore CVE Low jetty-server-9.4.48.v20220622
GHSA-qw69-rqj8-6qw8 Anchore CVE Medium jetty-server-9.4.48.v20220622
CVE-2023-26049 Anchore CVE Medium jetty-util-9.4.48.v20220622
CVE-2023-26048 Anchore CVE Medium jetty-util-ajax-9.4.48.v20220622
CVE-2023-26048 Anchore CVE Medium jetty-security-9.4.48.v20220622
CVE-2023-26048 Anchore CVE Medium jetty-io-9.4.48.v20220622
CVE-2023-26049 Anchore CVE Medium jetty-http-9.4.48.v20220622
CVE-2023-26049 Anchore CVE Medium jetty-util-ajax-9.4.48.v20220622
CVE-2023-26048 Anchore CVE Medium jetty-util-9.4.48.v20220622
CVE-2023-26049 Anchore CVE Medium jetty-io-9.4.48.v20220622
CVE-2023-26048 Anchore CVE Medium jetty-http-9.4.48.v20220622
CVE-2023-26049 Anchore CVE Medium jetty-security-9.4.48.v20220622
CVE-2023-26049 Anchore CVE Medium jetty-servlet-9.4.48.v20220622
CVE-2023-26048 Anchore CVE Medium jetty-servlet-9.4.48.v20220622
GHSA-6mjq-h674-j845 Anchore CVE Medium netty-handler-4.1.78.Final
CVE-2023-35116 Anchore CVE Medium jackson-databind-2.13.2.1
GHSA-hmr7-m48g-48f6 Anchore CVE Medium jetty-http-9.4.48.v20220622
CVE-2023-36479 Anchore CVE Medium jetty-http-9.4.48.v20220622
CVE-2023-36479 Anchore CVE Medium jetty-server-9.4.48.v20220622
CVE-2023-40167 Anchore CVE Medium jetty-util-ajax-9.4.48.v20220622
CVE-2023-36479 Anchore CVE Medium jetty-io-9.4.48.v20220622
CVE-2023-36479 Anchore CVE Medium jetty-util-9.4.48.v20220622
CVE-2023-40167 Anchore CVE Medium jetty-util-9.4.48.v20220622
CVE-2023-40167 Anchore CVE Medium jetty-servlet-9.4.48.v20220622
CVE-2023-40167 Anchore CVE Medium jetty-io-9.4.48.v20220622
CVE-2023-40167 Anchore CVE Medium jetty-server-9.4.48.v20220622
CVE-2023-36479 Anchore CVE Medium jetty-util-ajax-9.4.48.v20220622
CVE-2023-36479 Anchore CVE Medium jetty-security-9.4.48.v20220622
CVE-2023-41900 Anchore CVE Medium jetty-http-9.4.48.v20220622
CVE-2023-41900 Anchore CVE Medium jetty-servlet-9.4.48.v20220622
CVE-2023-41900 Anchore CVE Medium jetty-util-ajax-9.4.48.v20220622
CVE-2023-41900 Anchore CVE Medium jetty-security-9.4.48.v20220622
CVE-2023-41900 Anchore CVE Medium jetty-io-9.4.48.v20220622
CVE-2023-41900 Anchore CVE Medium jetty-server-9.4.48.v20220622
CVE-2023-41900 Anchore CVE Medium jetty-util-9.4.48.v20220622
CVE-2023-40167 Anchore CVE Medium jetty-security-9.4.48.v20220622
CVE-2023-36479 Anchore CVE Medium jetty-servlet-9.4.48.v20220622
GHSA-rhrv-645h-fjfh Anchore CVE High avro-1.11.1
GHSA-57m8-f3v5-hm5m Anchore CVE Medium netty-handler-4.1.78.Final
GHSA-xpw8-rcwv-8f8p Anchore CVE Medium netty-codec-http2-4.1.78.Final
GHSA-wgh7-54f2-x98r Anchore CVE High jetty-http-9.4.48.v20220622
CVE-2022-42004 Twistlock CVE High com.fasterxml.jackson.core_jackson-databind-2.13.2.1
CVE-2022-42003 Twistlock CVE High com.fasterxml.jackson.core_jackson-databind-2.13.2.1
CVE-2022-41881 Twistlock CVE High io.netty_netty-codec-4.1.78
CVE-2021-36090 Twistlock CVE High org.apache.commons_commons-compress-1.20
CVE-2021-35517 Twistlock CVE High org.apache.commons_commons-compress-1.20
CVE-2021-35516 Twistlock CVE High org.apache.commons_commons-compress-1.20
CVE-2021-35515 Twistlock CVE High org.apache.commons_commons-compress-1.20
CVE-2023-24815 Twistlock CVE Medium io.vertx_vertx-web-4.3.3
PRISMA-2023-0067 Twistlock CVE High com.fasterxml.jackson.core_jackson-core-2.13.2
CVE-2023-34462 Twistlock CVE Medium io.netty_netty-handler-4.1.78
CVE-2023-34462 Twistlock CVE Medium io.netty_netty-codec-4.1.78
CVE-2023-41900 Twistlock CVE Medium org.eclipse.jetty_jetty-io-9.4.48
CVE-2023-40167 Twistlock CVE Medium org.eclipse.jetty_jetty-http-9.4.48
CVE-2023-40167 Twistlock CVE Medium org.eclipse.jetty_jetty-io-9.4.48
CVE-2023-26049 Twistlock CVE Medium org.eclipse.jetty_jetty-io-9.4.48
CVE-2023-26048 Twistlock CVE Medium org.eclipse.jetty_jetty-io-9.4.48
CVE-2023-26048 Twistlock CVE Medium org.eclipse.jetty_jetty-server-9.4.48
CVE-2023-36479 Twistlock CVE Medium org.eclipse.jetty_jetty-io-9.4.48
CVE-2023-26049 Twistlock CVE Low org.eclipse.jetty_jetty-server-9.4.48
CVE-2023-39410 Twistlock CVE High org.apache.avro_avro-1.11.1
CVE-2023-4586 Twistlock CVE Medium io.netty_netty-handler-4.1.78
CVE-2023-4586 Twistlock CVE High io.netty_netty-codec-4.1.78
GHSA-xpw8-rcwv-8f8p Twistlock CVE Medium io.netty_netty-codec-http2-4.1.78
CVE-2023-44487 Twistlock CVE High io.netty_netty-codec-4.1.78

VAT: https://vat.dso.mil/vat/image?imageName=kinetica/pathfinder/flightplan_forwarder&tag=0.0.3&branch=master
More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=kinetica/pathfinder/flightplan_forwarder&tag=0.0.3&branch=master

Tasks

Contributor:

  • Provide justifications for findings in the VAT (docs)
  • Apply the ~"Hardening::Verification" label to this issue and wait for feedback

Iron Bank:

  • Review findings and justifications

Note: If the above process is rejected for any reason, the Verification label will be removed and the issue will be sent back to Open. Any comments will be listed in this issue for you to address. Once they have been addressed, you must re-add the Verification label.

Questions?

Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add /cc @ironbank-notifications/onboarding.

Additionally, Iron Bank hosts an AMA working session every Wednesday from 1630-1730EST to answer questions.

Edited by W. Scott Rogers
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

UNCLASSIFIED - NO CUI