CVEs Impacting Artifactory

JFrog Release Information

ft:sourceType
Paligo

The following is a list of CVEs that were discovered to impact Artifactory and were fixed.

CVE

Severity

Artifactory Fix Version

Fix Description

CVE-2024-23672

High

7.83.1

Upgraded Apache Tomcat to version 9.0.87.

CVE-2022-38751

CVE-2022-38752

Medium

7.52.0

Upgraded SnakeYAML to version 1.31.

CVE-2022-32213

Critical

7.41.7

Upgraded Node.js to version 16.16.0.

CVE-2022-32214

Critical

7.41.7

Upgraded Node.js to version 16.16.0.

CVE-2022-32215

Critical

7.41.7

Upgraded Node.js to version 16.16.0.

CVE-2022-32223

Critical

7.41.7

Upgraded Node.js to version 16.16.0.

CVE-2021-22573

High

7.41.4

Upgraded the google-oauth-client to version 1.33.3.

CVE-2022-32212

Critical

7.39.10

Upgraded Node.js to version 16.16.0.

CVE-2022-32213

Critical

7.39.10

Upgraded Node.js to version 16.16.0.

CVE-2022-32214

Critical

7.39.10

Upgraded Node.js to version 16.16.0.

CVE-2022-32215

Critical

7.39.10

Upgraded Node.js to version 16.16.0.

CVE-2022-32223

Critical

7.39.10

Upgraded Node.js to version 16.16.0.

CVE-2022-32212

Critical

7.38.16

Upgraded Node.js to version 16.16.0.

CVE-2022-32213

Critical

7.38.16

Upgraded Node.js to version 16.16.0.

CVE-2022-32214

Critical

7.38.16

Upgraded Node.js to version 16.16.0.

CVE-2022-32215

Critical

7.38.16

Upgraded Node.js to version 16.16.0.

CVE-2022-32223

Critical

7.38.16

Upgraded Node.js to version 16.16.0.

CVE-2022-32212

Critical

7.37.17

Upgraded Node.js to version 16.16.0.

CVE-2022-32213

Critical

7.37.17

Upgraded Node.js to version 16.16.0.

CVE-2022-32214

Critical

7.37.17

Upgraded Node.js to version 16.16.0.

CVE-2022-32215

Critical

7.37.18

Upgraded Node.js to version 16.16.0.

CVE-2022-32223

Critical

7.37.17

Upgraded Node.js to version 16.16.0.

CVE-2021-38561

High

7.37.13

Upgraded internal/language/parse.go version 0.3.6 to version 0.3.7.

CVE-2021-41091

Medium

7.35.1

Upgraded to docker v20.10.9.

Upgraded image-spec v.1.0.2.

CVE-2021-3765

High

7.31.10

Upgraded the validator version to 13.6.0.

CVE-2020-29582

Medium

7.25.4

(Cloud)

Updated to the latest release of Koplin from version 1.3.50 to 1.5.20.

CVE-2019-20104

High

7.24.1

Upgraded Crowd version to 3.7.2.

CVE-2020-14340

Medium

7.21.3

Upgraded org.jboss.xnio:xnio-nio to version3.8.4.Final.

CVE-2021-25122

High

7.17.4

Upgraded to Apache Tomcat version 8.5.63.

CVE-2019-10219

Medium

7.15.3

Upgraded org.hibernate:hibernate-validator to version 6.0.18.

CVE-2017-18214

High

6.23.25

npm moment.js library was upgraded to version 2.19.3.

CVE-2017-18640

High

6.23.0

Upgraded snakeyaml-1.23.jar from version 1.26 to 1.27.

CVE-2020-7692

Critical

6.23.0

Upgraded google-oauth-client library from version 1.27 to 1.31.

CVE-2019-12402

Medium

6.23.0

Upgraded Commons-compress lib was upgraded to version 1.20.

CVE-2020-15586 and Go issue golang.org/issue/34902

High

6.23.0

Upgraded to the latest version of Go 1.14.9.

CVE-2019-20104

High

6.23.0

UpgradedCrowd lib to 3.7.2 version.

CVE-2018-1000206

High

6.1

Artifactory now validates the actual value of the X-Request-With header instead of checking the existence of it.