基础信息
项目名称：min290/warm
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1715386946611363840/1715386946896576512
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| Apache Commons Compress 安存在拒绝服务漏洞 | 不加限制或调节的资源分配 | MPS-2021-10550 | CVE-2021-35517 | 高危 |
| Apache Commons Compress 存在拒绝服务漏洞 | 不加限制或调节的资源分配 | MPS-2021-10551 | CVE-2021-35516 | 高危 |
| Apache Commons Compress 存在拒绝服务漏洞 | 不加限制或调节的资源分配 | MPS-2021-10564 | CVE-2021-36090 | 高危 |
| Apache Commons Compress 无限循环漏洞 | 不可达退出条件的循环（无限循环） | MPS-2021-10565 | CVE-2021-35515 | 高危 |
| io.netty:netty-handler 存在证书验证不恰当漏洞 | 证书验证不恰当 | MPS-2022-12067 | 中危 | |
| hutool 表达式注入漏洞 | SQL注入 | MPS-2023-2459 | CVE-2023-24163 | 严重 |
| Netty 资源管理错误漏洞 | 拒绝服务 | MPS-9u07-bna1 | CVE-2023-34462 | 中危 |
| Hot Rod 安全漏洞 | 证书验证不恰当 | MPS-b7oj-adm3 | CVE-2023-4586 | 高危 |
| Hutool 安全漏洞 | 经典缓冲区溢出 | MPS-flgb-wpnd | CVE-2023-42277 | 严重 |
| Hutool 安全漏洞 | 经典缓冲区溢出 | MPS-l514-k0w7 | CVE-2023-42278 | 高危 |
| JSON-Java 安全漏洞 | 不加限制或调节的资源分配 | MPS-m4ex-dja2 | CVE-2023-5072 | 高危 |
| Hutool 安全漏洞 | 经典缓冲区溢出 | MPS-qb7x-rkp0 | CVE-2023-42276 | 严重 |
| Redisson 代码问题漏洞 | 反序列化 | MPS-t5lb-2zr9 | CVE-2023-42809 | 高危 |
| 【存在争议】FasterXML jackson-databind 代码问题漏洞 | 不加限制或调节的资源分配 | MPS-z1bx-p8y2 | CVE-2023-35116 | 中危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| cn.hutool:hutool-extra | 5.8.20 | 5.8.21 | 直接依赖 | 建议修复 |
| io.netty:netty-handler | 4.1.92.Final | 4.1.94.final | 间接依赖 | 建议修复 |
| org.apache.commons:commons-compress | 1.19 | 1.24.0 | 间接依赖 | 建议修复 |
| com.fasterxml.jackson.core:jackson-databind | 2.14.3 | 直接依赖 | 建议修复 | |
| org.json:json | 20230227 | 间接依赖 | 可选修复 | |
| cn.hutool:hutool-core | 5.8.20 | 5.8.22 | 直接依赖 | 可选修复 |
| org.redisson:redisson | 3.21.0 | 3.22.0 | 间接依赖 | 可选修复 |
| cn.hutool:hutool-json | 5.8.20 | 5.8.22 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| Apache-2.0 | 95 | 低 |
| MIT-0 | 1 | 低 |
| 自定义许可证 | 15 | 低 |
| BSD-2-Clause | 2 | 低 |
| MIT | 4 | 低 |
| EPL-1.0 | 4 | 低 |
| BSD-3-Clause | 5 | 低 |
| LGPL-2.1-or-later | 2 | 低 |
| LGPL-2.1 | 2 | 中 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| io.netty:netty-common | 4.1.92.Final | 间接依赖 | maven |
| com.mybatis-flex:mybatis-flex-solon-plugin | 1.6.4 | 直接依赖 | maven |
| com.warm:warm-plugin-gen | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.fasterxml.jackson.dataformat:jackson-dataformat-yaml | 2.14.2 | 间接依赖 | maven |
| org.noear:snack3 | 3.2.79 | 间接依赖 | maven |
| org.reactivestreams:reactive-streams | 1.0.4 | 间接依赖 | maven |
| com.jhlabs:filters | 2.0.235-1 | 间接依赖 | maven |
| com.fasterxml.jackson.core:jackson-annotations | 2.14.2 | 间接依赖 | maven |
| javax.cache:cache-api | 1.1.1 | 间接依赖 | maven |
| com.warm:warm-plugin-sys-api | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.noear:solon.logging | 2.5.3 | 间接依赖 | maven |
| com.warm:warm-demo-mf | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| io.netty:netty-transport-native-unix-common | 4.1.92.Final | 间接依赖 | maven |
| org.apache.xmlbeans:xmlbeans | 3.1.0 | 间接依赖 | maven |
| io.reactivex.rxjava3:rxjava | 3.1.6 | 间接依赖 | maven |
| cn.dev33:sa-token-core | 1.35.0.RC | 间接依赖 | maven |
| org.apache.poi:poi-ooxml | 4.1.2 | 直接依赖 | maven |
| org.noear:solon | 2.5.3 | 直接依赖 | maven |
| com.mybatis-flex:mybatis-flex-core | 1.6.4 | 间接依赖 | maven |
| com.github.xiaoymin:knife4j-openapi2-ui | 4.2.0 | 间接依赖 | maven |
| com.zaxxer:SparseBitSet | 1.2 | 间接依赖 | maven |
| org.noear:solon.docs.openapi2 | 2.5.3 | 间接依赖 | maven |
| com.warm:warm-base-json | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-plugin-gen-api | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| cn.hutool:hutool-extra | 5.8.20 | 直接依赖 | maven |
| cn.hutool:hutool-crypto | 5.8.20 | 间接依赖 | maven |
| com.warm:warm-base-doc | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.jodd:jodd-bean | 5.1.6 | 间接依赖 | maven |
| org.noear:solon.web.staticfiles | 2.5.3 | 直接依赖 | maven |
| org.apache.commons:commons-collections4 | 4.4 | 间接依赖 | maven |
| cn.hutool:hutool-json | 5.8.20 | 间接依赖 | maven |
| io.netty:netty-handler | 4.1.92.Final | 间接依赖 | maven |
| org.slf4j:slf4j-api | 2.0.7 | 间接依赖 | maven |
| com.warm:warm-plugin-job | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-base-satoken | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-base-thread | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-base-mf | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| ch.qos.logback:logback-classic | 1.3.7 | 间接依赖 | maven |
| io.netty:netty-transport | 4.1.92.Final | 间接依赖 | maven |
| org.freemarker:freemarker | 2.3.31 | 间接依赖 | maven |
| com.esotericsoftware:kryo | 5.5.0 | 间接依赖 | maven |
| org.noear:solon-openapi2-knife4j | 2.5.3 | 直接依赖 | maven |
| cn.dev33:sa-token-jwt | 1.35.0.RC | 直接依赖 | maven |
| org.mybatis:mybatis | 3.5.13 | 间接依赖 | maven |
| cn.hutool:hutool-jwt | 5.8.20 | 直接依赖 | maven |
| org.yaml:snakeyaml | 2.0 | 间接依赖 | maven |
| org.apache.commons:commons-pool2 | 2.11.1 | 间接依赖 | maven |
| org.noear:solon.serialization | 2.5.3 | 间接依赖 | maven |
| org.noear:solon.serialization.jackson | 2.5.3 | 直接依赖 | maven |
| io.netty:netty-codec-dns | 4.1.92.Final | 间接依赖 | maven |
| io.netty:netty-codec | 4.1.92.Final | 间接依赖 | maven |
| cn.hutool:hutool-setting | 5.8.20 | 间接依赖 | maven |
| redis.clients:jedis | 4.4.3 | 间接依赖 | maven |
| net.java.dev.jna:jna-platform | 5.13.0 | 间接依赖 | maven |
| org.noear:mybatis-solon-plugin | 2.5.3 | 间接依赖 | maven |
| com.alibaba.fastjson2:fastjson2 | 2.0.34 | 直接依赖 | maven |
| org.noear:solon.data | 2.5.3 | 间接依赖 | maven |
| com.mybatis-flex:mybatis-flex-processor | 1.6.4 | 间接依赖 | maven |
| com.github.virtuald:curvesapi | 1.06 | 间接依赖 | maven |
| com.google.code.gson:gson | 2.10.1 | 间接依赖 | maven |
| com.mchange:c3p0 | 0.9.5.4 | 间接依赖 | maven |
| org.noear:solon.validation | 2.5.3 | 直接依赖 | maven |
| org.smartboot.http:smart-http-server | 1.3.0 | 间接依赖 | maven |
| com.fasterxml.jackson.core:jackson-core | 2.14.2 | 间接依赖 | maven |
| com.github.pagehelper:pagehelper | 5.3.1 | 间接依赖 | maven |
| org.jodd:jodd-core | 5.1.6 | 间接依赖 | maven |
| cn.hutool:hutool-http | 5.8.20 | 直接依赖 | maven |
| com.mchange:mchange-commons-java | 0.2.15 | 间接依赖 | maven |
| commons-codec:commons-codec | 1.13 | 间接依赖 | maven |
| org.mapstruct:mapstruct | 1.5.5.Final | 直接依赖 | maven |
| io.netty:netty-resolver-dns | 4.1.92.Final | 间接依赖 | maven |
| com.warm:warm-base-excel | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.google.protobuf:protobuf-java | 3.21.9 | 间接依赖 | maven |
| cn.hutool:hutool-log | 5.8.20 | 间接依赖 | maven |
| org.objenesis:objenesis | 3.3 | 间接依赖 | maven |
| org.projectlombok:lombok | 1.18.26 | 直接依赖 | maven |
| com.warm:warm-orm-domain-mp | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.noear:solon.web.cors | 2.5.3 | 直接依赖 | maven |
| org.noear:solon.scheduling.quartz | 2.5.3 | 直接依赖 | maven |
| net.java.dev.jna:jna | 5.13.0 | 间接依赖 | maven |
| io.netty:netty-buffer | 4.1.92.Final | 间接依赖 | maven |
| org.noear:mybatis-pagehelper-solon-plugin | 2.5.3 | 直接依赖 | maven |
| com.warm:warm-demo-common | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.apache.poi:poi | 4.1.2 | 间接依赖 | maven |
| ch.qos.logback:logback-core | 1.3.7 | 间接依赖 | maven |
| org.noear:solon.i18n | 2.5.3 | 直接依赖 | maven |
| org.apache.commons:commons-math3 | 3.6.1 | 间接依赖 | maven |
| com.warm:warm-orm-mybatis-sys | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| io.projectreactor:reactor-core | 3.5.3 | 间接依赖 | maven |
| org.noear:solon.socketd | 2.5.3 | 间接依赖 | maven |
| com.warm:warm-base-redisson | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.jboss.marshalling:jboss-marshalling-river | 2.0.11.Final | 间接依赖 | maven |
| net.bytebuddy:byte-buddy | 1.14.0 | 间接依赖 | maven |
| com.fasterxml.jackson.core:jackson-annotations | 2.14.3 | 间接依赖 | maven |
| org.smartboot.socket:aio-core | 1.5.33 | 间接依赖 | maven |
| commons-io:commons-io | 2.11.0 | 直接依赖 | maven |
| com.fasterxml.jackson.core:jackson-databind | 2.14.3 | 直接依赖 | maven |
| org.ow2.asm:asm | 9.4 | 间接依赖 | maven |
| org.noear:solon.view | 2.5.3 | 间接依赖 | maven |
| org.jboss.marshalling:jboss-marshalling | 2.0.11.Final | 间接依赖 | maven |
| com.github.oshi:oshi-core | 6.4.3 | 直接依赖 | maven |
| org.noear:solon.cache.redisson | 2.5.3 | 直接依赖 | maven |
| com.esotericsoftware:minlog | 1.3.1 | 间接依赖 | maven |
| org.noear:solon.logging.logback | 2.5.3 | 直接依赖 | maven |
| org.apache.poi:poi-ooxml-schemas | 4.1.2 | 间接依赖 | maven |
| com.warm:warm-orm-mybatis-gen | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-base-mp | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| cn.hutool:hutool-core | 5.8.20 | 直接依赖 | maven |
| eu.bitwalker:UserAgentUtils | 1.21 | 直接依赖 | maven |
| com.warm:warm-orm-mybatis-job | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.apache.commons:commons-compress | 1.19 | 间接依赖 | maven |
| com.github.jsqlparser:jsqlparser | 4.2 | 间接依赖 | maven |
| com.mysql:mysql-connector-j | 8.0.33 | 直接依赖 | maven |
| com.warm:warm-orm-domain-mf | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.fusesource.jansi:jansi | 2.4.0 | 间接依赖 | maven |
| org.noear:solon.proxy | 2.5.3 | 直接依赖 | maven |
| com.warm:warm-base-captcha | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.redisson:redisson | 3.21.0 | 间接依赖 | maven |
| com.zaxxer:HikariCP | 4.0.3 | 直接依赖 | maven |
| com.warm:warm-select-api-redis | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.noear:redisson-solon-plugin | 2.5.3 | 直接依赖 | maven |
| com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | 2.14.3 | 间接依赖 | maven |
| io.netty:netty-resolver | 4.1.92.Final | 间接依赖 | maven |
| org.noear:solon.scheduling | 2.5.3 | 间接依赖 | maven |
| org.noear:solon.view.freemarker | 2.5.3 | 直接依赖 | maven |
| org.json:json | 20230227 | 间接依赖 | maven |
| com.warm:warm-base-dict | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.apache.commons:commons-lang3 | 3.12.0 | 直接依赖 | maven |
| com.warm:warm-base-redis | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.noear:solon.config.yaml | 2.5.3 | 直接依赖 | maven |
| com.warm:warm-base-datascope | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-base-log | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.smartboot.http:smart-http-common | 1.3.0 | 间接依赖 | maven |
| org.quartz-scheduler:quartz | 2.3.2 | 间接依赖 | maven |
| org.noear:solon.sessionstate.local | 2.5.3 | 直接依赖 | maven |
| com.warm:warm-plugin-monitor | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.noear:solon.boot | 2.5.3 | 间接依赖 | maven |
| com.warm:warm-base-web | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-base-core | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-select-pom-domain | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.noear:solon.docs | 2.5.3 | 间接依赖 | maven |
| com.warm:warm-plugin-job-api | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-select-pom-redis | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| org.smartboot.socket:aio-pro | 1.5.33 | 间接依赖 | maven |
| pro.fessional:kaptcha | 2.3.3 | 直接依赖 | maven |
| org.noear:solon.data.dynamicds | 2.5.3 | 直接依赖 | maven |
| com.esotericsoftware:reflectasm | 1.11.9 | 间接依赖 | maven |
| org.noear:redisx | 1.4.9 | 间接依赖 | maven |
| com.fasterxml.jackson.core:jackson-core | 2.14.3 | 间接依赖 | maven |
| com.warm:warm-base-xss | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| com.warm:warm-plugin-sys | 0.0.1-SNAPSHOT | 直接依赖 | maven |
| io.swagger:swagger-models | 1.6.11 | 间接依赖 | maven |
| cn.dev33:sa-token-solon-plugin | 1.35.0.RC | 直接依赖 | maven |
| org.noear:solon.boot.smarthttp | 2.5.3 | 直接依赖 | maven |
| org.noear:solon.cache.jedis | 2.5.3 | 直接依赖 | maven |
| io.swagger:swagger-annotations | 1.6.11 | 间接依赖 | maven |
| com.mybatis-flex:mybatis-flex-annotation | 1.6.4 | 直接依赖 | maven |