[GHSA-wwq7-pxwc-p4rc] Improper Input Validation in Apache Axis2 #6497
Conversation
github-actions
bot
changed the base branch from
main
to
steinybot/advisory-improvement-6497
There was a problem hiding this comment.
Pull request overview
This pull request updates a GitHub Security Advisory for CVE-2012-5785, which affects Apache Axis2/Java. The change adds a second affected package entry to clarify that the vulnerability impacts org.apache.axis2:axis2-transport-http in addition to the already-listed org.apache.axis2:axis2 package.
- Adds
org.apache.axis2:axis2-transport-httpas an affected package - Updates the modified timestamp to
2023-01-27T05:02:15Z - Addresses the comment in the PR description that the issue is in the
axis2-transport-httpmodule rather than just the fat JAR
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| } | ||
| ] | ||
| } | ||
| ] |
There was a problem hiding this comment.
The new package entry for org.apache.axis2:axis2-transport-http is missing a fixed version in the events array. According to the existing entry for org.apache.axis2:axis2, the vulnerability was fixed in version 1.8.0. The new entry should include a similar fixed event to specify which version resolved the vulnerability.
Compare with the existing entry (lines 18-33) which includes:
{
"introduced": "0"
},
{
"fixed": "1.8.0"
}The new entry should follow the same pattern to provide complete vulnerability information.
| ] | ||
| } |
There was a problem hiding this comment.
The new package entry is missing database_specific field with last_known_affected_version_range information. The existing entry for org.apache.axis2:axis2 includes this field (line 31-33) which provides important context about the last affected version. Consider adding similar information for the axis2-transport-http package to maintain consistency and completeness.
| ] | |
| } | |
| ] | |
| , | |
| "database_specific": { | |
| "last_known_affected_version_range": "<= 1.6.2" | |
| } | |
| } |
advisory-database
bot
merged commit 7e9d8ee
into
steinybot/advisory-improvement-6497
|
Hi @steinybot! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
I'm fairly certain that this is in the
axis2-transport-httpmodule. Theaxis2module is a fat JAR containing a whole lot of other modules. See the https://repo1.maven.org/maven2/org/apache/axis2/axis2/1.5.1/axis2-1.5.1.pom. I don't know what version though. Presumably the same ones listed here although the<= 1.6.2looks wrong. I think this affects 1.7 too.