poi-ooxml-3.14.jar: 2 vulnerabilities (highest severity is: 5.5)

[dev-mend-for-github-com]

Vulnerable Library - poi-ooxml-3.14.jar

Apache POI - Java API To Access Microsoft Format Files

Library home page: http://poi.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml

Found in HEAD commit: d672f5c3ea38dd0e23359cf12d310c2c27abf963

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (poi-ooxml version)	Remediation Possible**	Reachability
CVE-2019-12415	Medium	5.5	poi-ooxml-3.14.jar	Direct	4.1.1	✅
CVE-2017-5644	Medium	5.5	poi-ooxml-3.14.jar	Direct	3.15-beta1	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-12415

Vulnerable Library - poi-ooxml-3.14.jar

Apache POI - Java API To Access Microsoft Format Files

Library home page: http://poi.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml

Dependency Hierarchy:

• ❌ poi-ooxml-3.14.jar (Vulnerable Library)

Found in HEAD commit: d672f5c3ea38dd0e23359cf12d310c2c27abf963

Found in base branch: master

Vulnerability Details

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Publish Date: 2019-10-23

URL: CVE-2019-12415

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12415

Release Date: 2019-10-23

Fix Resolution: 4.1.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2017-5644

Vulnerable Library - poi-ooxml-3.14.jar

Apache POI - Java API To Access Microsoft Format Files

Library home page: http://poi.apache.org/

Path to dependency file: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-poi-bundle/nifi-poi-processors/pom.xml

Dependency Hierarchy:

• ❌ poi-ooxml-3.14.jar (Vulnerable Library)

Found in HEAD commit: d672f5c3ea38dd0e23359cf12d310c2c27abf963

Found in base branch: master

Vulnerability Details

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Publish Date: 2017-03-24

URL: CVE-2017-5644

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5644

Release Date: 2017-03-24

Fix Resolution: 3.15-beta1

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

[dev-mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[dev-mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.