Summary
JFrog Artifactory nutzt verschiedene Komponenten von Drittanbietern. Diese enthalten mehrere Schwachstellen. Neuen Informationen von JFrog zufolge sind diese Schwachstellen jedoch nicht in Produkten von JFrog ausnutzbar.
Product
JFrog Artifactory ist eine universelle DevOps-Lösung.
Vulnerabilities 18
-
Critical 9.8CVE-2021-44906 Public exploit
Prototype Pollution in minimist
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
-
Critical 9.1
HTTP Request Smuggling in Netty
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
-
Critical 9.1CVE-2021-26291 Public exploit
block repositories using http by default
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a posit…
-
High 8.8
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
-
High 8.2
Prototype Pollution
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or…
-
High 7.5
HTTP Request Smuggling in Netty
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
-
High 7.5
Inefficient Regular Expression Complexity in chalk/ansi-regex
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Denial of Service (DoS)
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
-
High 7.5
golang.org/x/crypto/ssh Denial of service via crafted Signer
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
-
High 7.5
Stack exhaustion when unmarshaling certain documents in encoding/xml
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
-
High 7.5
Stack exhaustion when decoding certain messages in encoding/gob
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
-
Medium 5.6
Command Injection
This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.
-
Medium 5.5
Stack exhaustion due to deeply nested types in go/parser
Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.
-
Medium 5.5
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information…
-
Medium 5.3
yargs-parser Vulnerable to Prototype Pollution
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
-
Medium 4.7
Azure Storage Library Information Disclosure Vulnerability
Azure Storage Library Information Disclosure Vulnerability
-
Medium —CVE-2019-20445 EPSS 14%
HTTP Request Smuggling in Netty
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
-
Unscored —
Stack exhaustion from deeply nested XML documents in encoding/xml
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
Revision history
-
#4
Neue Updates aufgenommen
-
#3
Neue Updates von HCL aufgenommen
-
#2
Neue Informationen von JFrog aufgenommen
-
#1
Initiale Fassung
References
-
JFrog Fixed Security Vulnerabilities vom 2022-11-20
https://www.jfrog.com/confluence/display/JFROG/Fixed+Security+Vulnerabilities
-
JFrog Fixed Security Vulnerabilities - Änderungen vom 2022-11-24
https://www.jfrog.com/confluence/pages/diffpagesbyversion.action?pageId=102634317&selectedPageVersions=159&selectedPageVersions=156
-
HCL Article KB0102172 vom 2022-12-19
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102172
-
Atlassian Security Bulletin - November 18 2025
https://confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html