medium5.9
CVE-2022-31139
UnsafeAccessor 1.4.0 until 1.7.0 has no security checking for UnsafeAccess.getInstance()
Impact
### Overview Affected versions have no limit to using unsafe-accessor. Can be ignored if `SecurityCheck.AccessLimiter` not setup ### Details If UA was loaded as a named module, the internal data of UA will be protected by JVM and others can only access UA via UA's standard api. Main application can setup `SecurityCheck.AccessLimiter` for UA to limit accesses to UA. Untrusted code can access UA without lmitation in affected versions even UA was loaded as a named module. ### References [The commit to fix](https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.github.karlatemp:unsafe-accessor | >= 1.4.0, < 1.7.0 | 1.7.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Unsafe Accessor Project | Unsafe Accessor | from 1.4.0 before 1.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd
- https://github.com/Karlatemp/UnsafeAccessor/releases/tag/1.7.0
- https://github.com/Karlatemp/UnsafeAccessor/security/advisories/GHSA-cr6p-23cf-w9g9
- https://github.com/advisories/GHSA-cr6p-23cf-w9g9
- https://nvd.nist.gov/vuln/detail/CVE-2022-31139