GHSA-cr6p-23cf-w9g9
UnsafeAccessor 1.4.0 until 1.7.0 has no security checking for UnsafeAccess.getInstance()
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.github.karlatemp:unsafe-accessor | >= 1.4.0, < 1.7.0 | 1.7.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Overview
Affected versions have no limit to using unsafe-accessor. Can be ignored if `SecurityCheck.AccessLimiter` not setup
### Details
If UA was loaded as a named module, the internal data of UA will be protected by JVM and others can only access UA via UA's standard api.
Main application can setup `SecurityCheck.AccessLimiter` for UA to limit accesses to UA.
Untrusted code can access UA without lmitation in affected versions even UA was loaded as a named module.
### References
[The commit to fix](https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd)
References
External links from the advisory. They lead to third-party sites.
- https://github.com/Karlatemp/UnsafeAccessor/security/advisories/GHSA-cr6p-23cf-w9g9
- https://nvd.nist.gov/vuln/detail/CVE-2022-31139
- https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd
- https://github.com/Karlatemp/UnsafeAccessor
- https://github.com/Karlatemp/UnsafeAccessor/releases/tag/1.7.0