skylot jadx affected by Incorrect Behavior Order in vulnerable dependency

published 2022-07-21 4y ago modified 2024-11-28 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact Vulnerable library protobuf-java 3.11.4 (CVE-2021-22569)

### Patches Dependency updated in jadx 1.4.3

### References According to the AquaSecurity report: ![05F1C52A666E4FCC844ABD085BD55124](https://user-images.githubusercontent.com/118523/177364939-087e2144-9a8a-4594-ae90-eb2acb0a2036.png)

Also, Maven repository have links to this and other vulnerabilities from dependencies: https://mvnrepository.com/artifact/com.google.protobuf/protobuf-java/3.11.4

Patch / fix

fixed in 1 links 1

maven io.github.skylot:jadx-core 1.4.3

github.com/skylot/jadx/releases/tag/v1.4.3 release

Is GHSA-fjh6-p566-wr6q in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
maven	io.github.skylot:jadx-core	<1.4.3	1.4.3

Classification

Weakness

CWE-696 Incorrect Behavior Order

References

Sources

GitHub Advisory GHSA-fjh6-p566-wr6q

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.