PT-2021-24450 · Unknown+1 · Npm-Groovy-Lint+1

Published 2021-12-20 · Updated 2021-12-20

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: npm-groovy-lint versions prior to 9.1.0

Description: The issue concerns remote code execution via jndi rendering due to the inclusion of vulnerable versions of the Log4j library.

Recommendations: For versions prior to 9.1.0, update to version 9.1.0 or later to resolve the issue.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-QC22-QWM9-J8RX

Affected Products

Log4J

Npm-Groovy-Lint

References · 6

• https://osv.dev/vulnerability/GHSA-qc22-qwm9-j8rx · Vendor Advisory
• https://github.com/nvuillam/npm-groovy-lint/issues/194 · Note
• https://github.com/nvuillam/npm-groovy-lint/commit/0b664519019442052e0190170c2b1c5aff7d72e7 · Note
• https://github.com/nvuillam/npm-groovy-lint · Note
• https://github.com/nvuillam/npm-groovy-lint/pull/195 · Note
• https://github.com/advisories/GHSA-jfh8-c2jp-5v3q · Note