[PRD-6159] - upgrading the apache poi library to 5.2.5 version for Ex…

…cel writer step

 Note:

Frogbot also supports Contextual Analysis, Secret Detection, IaC and SAST Vulnerabilities Scanning. This features are included as part of the JFrog Advanced Security package, which isn't enabled on your system.

🐸 JFrog Frogbot

:warning: Build finished in 17m 33s
Build command:
mvn clean verify -B -e -Daudit -Djs.no.sandbox -pl \
plugins/excel/core,plugins/xml

:no_entry: Failed Tests
:cloud_with_lightning_and_rain: 79 test(s) failed:
org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow12 (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_InlinedStrings_Streaming (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSX (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSXStream (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_Header_StartRow0 (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_Header_StartRowX (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_InlinedStrings_NoStreaming (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_InlinedStrings_Streaming (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow0 (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow5 (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_NoHeader_StartRow0 (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_NoHeader_StartRowX (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSXCompressionRatioIsBig (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_SharedStrings_Streaming (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_InlinedStrings_NoStreaming (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_SharedStrings_Streaming (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_SharedStrings_NoStreaming (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_SharedStrings_NoStreaming (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow0 (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow5 (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow12 (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testNullDateCell (click to expand)
'org.apache.xmlbeans.XmlOptions org.apache.xmlbeans.XmlOptions.setUseDefaultNamespace(boolean)'

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testEmptySheet_row0 (click to expand)
Unexpected exception, expected<java.lang.ArrayIndexOutOfBoundsException> but was<org.mockito.exceptions.base.MockitoException>

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testEmptySheet_row1 (click to expand)
Unexpected exception, expected<java.lang.ArrayIndexOutOfBoundsException> but was<java.lang.NoClassDefFoundError>

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadCells (click to expand)
Could not initialize class org.apache.poi.xssf.model.SharedStringsTable

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadRowRA (click to expand)
Could not initialize class org.apache.poi.xssf.model.SharedStringsTable

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadData (click to expand)
Could not initialize class org.apache.poi.xssf.model.SharedStringsTable

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadSameRow (click to expand)
Could not initialize class org.apache.poi.xssf.model.SharedStringsTable

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadEmptyRow (click to expand)
Could not initialize class org.apache.poi.xssf.model.SharedStringsTable

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testInlineString (click to expand)
Could not initialize class org.apache.poi.xssf.model.SharedStringsTable

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testNoUsedRangeSpecified (click to expand)
Could not initialize class org.apache.poi.xssf.model.SharedStringsTable

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testCreateFolder (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testNullsEmptyStr (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testDataValidationExtension (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testWriteStreamingTemplate (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testWriteStreamingTemplateOutFields (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testNullsBlank (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testWriteUsingTemplateWithFormatting (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testWriteUsingTemplateWithFormatting (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueString (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueString (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBigNumber (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBigNumber (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_Stream_NoTemplate (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_Stream_NoTemplate (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xls_Template (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xls_Template (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueInteger (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueInteger (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueInternetAddress (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueInternetAddress (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xls_NoTemplate (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xls_NoTemplate (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueDate (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueDate (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_NoStream_Template (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_NoStream_Template (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testProtectSheet (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testProtectSheet (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_NoStream_NoTemplate (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_NoStream_NoTemplate (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testMaxSheetNameLength (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testMaxSheetNameLength (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueTimestamp (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueTimestamp (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_Stream_Template (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_Stream_Template (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBinary (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBinary (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBoolean (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBoolean (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testPrepareNextOutputFile (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testPrepareNextOutputFile (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueNumber (click to expand)
'org.apache.commons.io.input.UnsynchronizedByteArrayInputStream$Builder org.apache.commons.io.input.UnsynchronizedByteArrayInputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueNumber (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsCleared (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsSet (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsNotSet (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_StyleFormatTest.testStyleFormatXssf (click to expand)
'org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream$Builder org.apache.commons.io.output.UnsynchronizedByteArrayOutputStream.builder()'

Tests run: 136, Failures: 79, Skipped: 0    Test Results

:information_source:  This is an automatic message

:x: Build failed in 1m 34s
Build command:
mvn clean verify -B -e -Daudit -Djs.no.sandbox

:exclamation: No tests found!
Errors:
Filtered log (click to expand)

docker login failed

:information_source:  This is an automatic message

:x: Build failed in 44m 58s
Build command:
mvn clean verify -B -e -Daudit -Djs.no.sandbox

:no_entry: Failed Tests
:cloud_with_lightning_and_rain: 81 test(s) failed:
org.pentaho.di.core.xml.XMLHandlerUnitTest.addTagValueBinary (click to expand)
expected:<...ytedata>H4sIAAAAAAAA[/w]tJLS5RcEksSQQAL4PL8Q...> but was:<...ytedata>H4sIAAAAAAAA[AA]tJLS5RcEksSQQAL4PL8Q...>

org.pentaho.ui.database.event.FragmentHandlerTest.org.pentaho.ui.database.event.FragmentHandlerTest (click to expand)
No more handles [gtk_init_check() failed]

org.pentaho.di.trans.steps.fieldsplitter.FieldSplitterTest.testSplitFields (click to expand)
Output row is of an unexpected length expected:<4> but was:<3>

org.pentaho.di.trans.steps.aggregaterows.AggregateRowsTest.testProcessRow (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.creditcardvalidator.CreditCardValidatorMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.edi2xml.Edi2XmlMetaTest.testStepMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mailinput.MailInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.getrepositorynames.GetRepositoryNamesMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.googleanalytics.GaInputStepMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.gpload.GPLoadMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.infobrightoutput.InfobrightLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputMetaLoadSaveTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNullChangedToFalse_NoNullInOutput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSingleObjPred (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExpressionWithLegacyModeEnable (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildDot (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildBracketsNDots (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExpMismatchError (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBfsMatchOrder (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNullTrue_NullsInOutput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExpressionWithLegacyModeDisable (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBadInput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testAttrFilter (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndex (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullProp (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputPathResolutionSuccess (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testObjectOut (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSmallDoubles (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildBrackets (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testArrayOut (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRemoveSourceField (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRepeatFieldSingleObj (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testZeroSizeFile (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testUrlInput (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBicycleAsterisk (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexList (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testFileList (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExtraFileFields (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexFirst (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testZipFileInput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNoFilesInListError (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullFileList (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testErrorRedirect (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIncludeNulls_N (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIncludeNulls_Y (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNull (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testLargeDoubles (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJgdArray (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testParsingWithNullFinding (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRowLimit (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExpMismatchPathLeafToNull (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullInputs (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBadExp (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexLastObj (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputPathResolution (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExp (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIfIgnorePathDoNotSkipRowIfInputIsNullOrFieldNotFound (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSingleField (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputMetaInputFieldsNotOverwritten (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testPathMissingIgnore (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBracketEscape (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.ldapinput.LDAPInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.ldapoutput.LDAPOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mailvalidator.MailValidatorMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mondrianinput.MondrianInputMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.accessinput.AccessInputMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.accessoutput.AccessOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mysqlbulkloader.MySQLBulkLoaderMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.orabulkloader.OraBulkLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.pgbulkloader.PGBulkLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.randomccnumber.RandomCCNumberGeneratorMetaTest.testStepMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.rssinput.RssInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.rssoutput.RssOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforcedelete.SalesforceDeleteMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceinput.SalesforceInputMetaTest.testSalesforceInputMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceinsert.SalesforceInsertMetaTest.testSalesforceInsertMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceupdate.SalesforceUpdateMetaTest.testSalesforceUpdateMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceupsert.SalesforceUpsertMetaTest.testSalesforceUpsertMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.shapefilereader.ShapeFileReaderTest.processRowPolyLineCloneRowTest (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.shapefilereader.ShapeFileReaderTest.processRowPolyLineCloneRowTest (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.yamlinput.YamlInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

Tests run: 5243, Failures: 81, Skipped: 23    Test Results

Errors:
Filtered log (click to expand)

script returned exit code 1

:information_source:  This is an automatic message

:x: Build failed in 43m 51s
Build command:
mvn clean verify -B -e -Daudit -Djs.no.sandbox

:no_entry: Failed Tests
:cloud_with_lightning_and_rain: 81 test(s) failed:
org.pentaho.di.core.xml.XMLHandlerUnitTest.addTagValueBinary (click to expand)
expected:<...ytedata>H4sIAAAAAAAA[/w]tJLS5RcEksSQQAL4PL8Q...> but was:<...ytedata>H4sIAAAAAAAA[AA]tJLS5RcEksSQQAL4PL8Q...>

org.pentaho.ui.database.event.FragmentHandlerTest.org.pentaho.ui.database.event.FragmentHandlerTest (click to expand)
No more handles [gtk_init_check() failed]

org.pentaho.di.trans.steps.fieldsplitter.FieldSplitterTest.testSplitFields (click to expand)
Output row is of an unexpected length expected:<4> but was:<3>

org.pentaho.di.trans.steps.aggregaterows.AggregateRowsTest.testProcessRow (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.creditcardvalidator.CreditCardValidatorMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.edi2xml.Edi2XmlMetaTest.testStepMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mailinput.MailInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.getrepositorynames.GetRepositoryNamesMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.googleanalytics.GaInputStepMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.gpload.GPLoadMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.infobrightoutput.InfobrightLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputMetaLoadSaveTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNullChangedToFalse_NoNullInOutput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSingleObjPred (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExpressionWithLegacyModeEnable (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildDot (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildBracketsNDots (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExpMismatchError (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBfsMatchOrder (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNullTrue_NullsInOutput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExpressionWithLegacyModeDisable (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBadInput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testAttrFilter (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndex (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullProp (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputPathResolutionSuccess (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testObjectOut (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSmallDoubles (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildBrackets (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testArrayOut (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRemoveSourceField (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRepeatFieldSingleObj (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testZeroSizeFile (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testUrlInput (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBicycleAsterisk (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexList (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testFileList (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExtraFileFields (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexFirst (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testZipFileInput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNoFilesInListError (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullFileList (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testErrorRedirect (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIncludeNulls_N (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIncludeNulls_Y (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNull (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testLargeDoubles (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJgdArray (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testParsingWithNullFinding (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRowLimit (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExpMismatchPathLeafToNull (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullInputs (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBadExp (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexLastObj (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputPathResolution (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExp (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIfIgnorePathDoNotSkipRowIfInputIsNullOrFieldNotFound (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSingleField (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputMetaInputFieldsNotOverwritten (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testPathMissingIgnore (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBracketEscape (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.ldapinput.LDAPInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.ldapoutput.LDAPOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mailvalidator.MailValidatorMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mondrianinput.MondrianInputMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.accessinput.AccessInputMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.accessoutput.AccessOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mysqlbulkloader.MySQLBulkLoaderMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.orabulkloader.OraBulkLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.pgbulkloader.PGBulkLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.randomccnumber.RandomCCNumberGeneratorMetaTest.testStepMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.rssinput.RssInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.rssoutput.RssOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforcedelete.SalesforceDeleteMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceinput.SalesforceInputMetaTest.testSalesforceInputMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceinsert.SalesforceInsertMetaTest.testSalesforceInsertMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceupdate.SalesforceUpdateMetaTest.testSalesforceUpdateMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceupsert.SalesforceUpsertMetaTest.testSalesforceUpsertMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.shapefilereader.ShapeFileReaderTest.processRowPolyLineCloneRowTest (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.shapefilereader.ShapeFileReaderTest.processRowPolyLineCloneRowTest (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.yamlinput.YamlInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

Tests run: 5243, Failures: 81, Skipped: 23    Test Results

Errors:
Filtered log (click to expand)

script returned exit code 1

:information_source:  This is an automatic message

📦 Vulnerable Dependencies
✍ Summary

SEVERITY
DIRECT DEPENDENCIES
IMPACTED DEPENDENCY
FIXED VERSIONS
CVES

Critical
org.apache.activemq:artemis-junit:2.5.0
org.apache.activemq:artemis-server 2.5.0
[2.31.2]
CVE-2023-46604

Critical
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.44.Final]
CVE-2019-20444

Critical
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.44.Final]
CVE-2019-20445

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec 4.1.22.Final
[4.1.68.Final]
CVE-2021-37136

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
org.apache.activemq:artemis-core-client 2.5.0
[2.19.1]
CVE-2022-23913

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-handler 4.1.22.Final
[4.1.46]
CVE-2020-11612

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec 4.1.22.Final
[4.1.68.Final]
CVE-2021-37137

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.71.Final]
CVE-2021-43797

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.108.Final]
CVE-2024-29025

  Medium
org.apache.activemq:artemis-junit:2.5.0
org.apache.activemq:artemis-server 2.5.0
[2.24.0]
CVE-2022-35278

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.59.Final]
CVE-2021-21290

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-handler 4.1.22.Final
[4.1.94.Final]
CVE-2023-34462

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.77.Final]
CVE-2022-24823

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
org.apache.activemq:artemis-core-client 2.5.0
[2.19.1]
CVE-2021-4040

 🔬 Research Details

 [ CVE-2023-46604 ] org.apache.activemq:artemis-server 2.5.0

Description:
Apache ActiveMQ is a widely-used open-source message broker written in Java, known for its multi-protocol compatibility. It offers clients the flexibility of choosing from various programming languages and platforms, with support for JavaScript, C, C++, Python, .NET, and others.
Apache ActiveMQ Artemis is a next-generation, high-performance message broker, designed as a successor to the classic Apache ActiveMQ, offering improved performance, scalability, and a more modern architecture for messaging applications.
ActiveMQ can broker multiple protocol formats, such as AMQP, STOMP, MQTT, and OpenWire.
The OpenWire implementation in ActiveMQ was discovered to be vulnerable to a deserialization attack, which may lead to remote code execution by unauthenticated network attackers.
The vulnerability is highly likely to be exploited, since it is exploitable by unauthenticated network attackers, in the default ActiveMQ server configuration, by using a public exploit and with no need for target-specific research.
Successful exploitation requires a class on the classpath to be used as a gadget, which can execute arbitrary code simply by instantiating it with a String parameter.
One of the classes shipped in the classic ActiveMQ is org.springframework.context.support.ClassPathXmlApplicationContext.
The purpose of ClassPathXmlApplicationContext is to retrieve an XML application configuration file via HTTP from a remote location on the network, which is used in the published PoCs to execute arbitrary code.
The Artemis versions also support the OpenWire protocol but does not ship with this gadget class, so exploitation of Artemis has not yet been proven.
The OpenWire transport is enabled by default and listens on TCP port 61616.
Remediation:
Deployment mitigations
You can switch from using the vulnerable OpenWire protocol to another protocol (and adjust the MQTT clients accordingly).
On ActiveMQ (the default Classic project):
In the configuration file activemq.xml change the transport connector to one of the following - AMQP / MQTT / STOMP / Websockets.
An example of a vulnerable transport connector:
<transportConnector name="tcp" uri="tcp://<IP_ADDRESS>:61616"/>

An example of non-vulnerable transport connectors:
<transportConnector name="amqp" uri="amqp://<IP_ADDRESS>:5672"/>
<transportConnector name="stomp" uri="stomp://<IP_ADDRESS>:61613"/>
<transportConnector name="mqtt" uri="mqtt://<IP_ADDRESS>:1883"/>
<transportConnector name="ws" uri="ws://<IP_ADDRESS>:61614"/>

On ActiveMQ Artemis:
In the configuration file broker.xml change the protocol to one of the following - CORE / AMQP / MQTT / STOMP.
Example of a vulnerable configuration where all protocols are enabled including OpenWire:
<acceptors>
   <acceptor>tcp://localhost:61616</acceptor>
</acceptors>

Example of a vulnerable configuration where the protocol OpenWire is specified:
<acceptors>
   <acceptor>tcp://localhost:61616?protocols=OPENWIRE</acceptor>
</acceptors>

Example of a not-vulnerable configuration using MQTT:
<acceptors>
   <acceptor>tcp://localhost:61616?protocols=MQTT</acceptor>
</acceptors>

 [ CVE-2019-20444 ] io.netty:netty-codec-http 4.1.22.Final

Description:
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

 [ CVE-2019-20445 ] io.netty:netty-codec-http 4.1.22.Final

Description:
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

 [ CVE-2021-37136 ] io.netty:netty-codec 4.1.22.Final

Description:
netty is a popular client/server framework which enables quick and easy development of network applications such as protocol servers and clients.
A vulnerability was found in netty's Bzip2 decoder - when using the netty library and accepting arbitrary data streams to decode, netty does not limit the stream in any way.
An attacker that can submit a big file to decompress, may cause memory exhaustion which will lead to denial of service on the netty daemon process and possibly other processes on the same machine.
Example code that can trigger the issue -
public static void main(String[] args) throws Exception {
    Bzip2Decoder decoder = new Bzip2Decoder(); // Create the decompressor
    final ByteBufAllocator allocator = new PooledByteBufAllocator(false);
    FileInputStream file = new FileInputStream("C:\\temp\\100GB.bz2"); // External input
    int inputChunks = 64 * 1024;
    ByteBuf buf = allocator.heapBuffer(inputChunks);
    ChannelHandlerContext ctx = new StubChannelHandlerContext(allocator);
    while (buf.writeBytes(file, buf.writableBytes()) >= 0) {
        System.out.println("Input: " + buf.capacity());
        decoder.channelRead(ctx, buf); // BUG, No internal resource release!
        buf = allocator.heapBuffer(inputChunks);
        decoder.channelReadComplete(ctx);
}

 [ CVE-2022-23913 ] org.apache.activemq:artemis-core-client 2.5.0

Description:
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

 [ CVE-2020-11612 ] io.netty:netty-handler 4.1.22.Final

Description:
Java applications that use the Netty network framework and specifically decompressing attacker-supplied data using the ZlibDecoder, JdkZlibDecoder and JZlibDecoder classes could be vulnerable to memory exhaustion and DoS (denial of service).
In addition, Java applications that use the Netty HTTP package could be vulnerable as well as it could use the vulnerable classes indirectly when handling compressed content (for example here in the HttpContentDecompressor class).
This vulnerability originates from the fact that it isn't generally possible to pre-determine the memory needed when decompressing a stream compressed using DEFLATE (the data compression file format used by all of the classes above) and that none of the decompression classes above enforce or allow the developer using them to enforce the size limit for the decompressed buffer.
If the stream is provided from untrusted input, an attacker which is able to supply data that was compressed using one of the vulnerable codecs to a Netty-based application, could cause it to run out of memory, leading to the application halting or crashing and a DoS.
The patch introduced in version 4.1.46 allows limiting the decompressed buffer to a configurable size.
Remediation:
Deployment mitigations
If possible, avoid using Netty's ZlibDecoder for decompressing user input. Consider using other libraries such as java.util.zip

 [ CVE-2021-37137 ] io.netty:netty-codec 4.1.22.Final

Description:
netty is a popular client/server framework which enables quick and easy development of network applications such as protocol servers and clients.
A vulnerability was found in netty's Snappy decoder - when using the netty library and accepting arbitrary data streams to decode, netty does not limit the stream in any way.
An attacker that can submit a big file to decompress, may cause memory exhaustion which will lead to denial of service on the netty daemon process and possibly other processes on the same machine.
Example code that can trigger the issue -
public static void main(String[] args) throws Exception {
    SnappyFrameDecoder decoder = new SnappyFrameDecoder(); // Create the decompressor
    final ByteBufAllocator allocator = new PooledByteBufAllocator(false);
    FileInputStream file = new FileInputStream("C:\\temp\\100GB.snappy"); // External input
    int inputChunks = 64 * 1024;
    ByteBuf buf = allocator.heapBuffer(inputChunks);
    ChannelHandlerContext ctx = new StubChannelHandlerContext(allocator);
    while (buf.writeBytes(file, buf.writableBytes()) >= 0) {
        System.out.println("Input: " + buf.capacity());
        decoder.channelRead(ctx, buf); // BUG, No internal resource release!
        buf = allocator.heapBuffer(inputChunks);
        decoder.channelReadComplete(ctx);
}

 [ CVE-2021-43797 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

 [ CVE-2024-29025 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

 [ CVE-2022-35278 ] org.apache.activemq:artemis-server 2.5.0

Description:
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

 [ CVE-2021-21290 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven framework for developing client and server Java applications.
Netty's io.netty:netty-codec-http package offers multipart decoders (HttpPostMultipartRequestDecoder) for handling HTTP POST requests whose BODY data requires splitting the request to several requests, i.e. in case multiple files are uploaded or when mixed data types are uploaded.
In Netty prior to 4.1.77.Final, local information disclosure may occur when file uploads are stored on the disk, since they're created in the shared system temporary directory, using world-readable permissions. For files to be stored on the disk, the uploaded file size must exceed the minSize threshold, which can also be set upon object creation, and defaults to 16KB. Alternatively, files will be stored on the disk if the HttpDataFactory used by HttpPostMultipartRequestDecoder is initialized to always use the disk by setting the useDisk parameter to True.
This vulnerability's fix is incomplete. In order to completely fix the vulnerability, this CVE's patch must be applied together with CVE-2022-24823's patch.
Unix-based operating systems are affected, as well as older versions of macOS and Windows, which share a temporary directory between all users. Additionally, only Netty applications running on Java 6 or lower are affected. Since Java 6 is an extremely old version, this greatly reduces the amount of potentially vulnerable machines.
Remediation:
Deployment mitigations
Change the configured JVM's java.io.tmpdir to a directory which is not readable by all. For instance:
java -Djava.io.tmpdir=/tmp/private

Development mitigations
Use DefaultHttpDataFactory.setBaseDir to set the directory in which uploaded files are stored to one that isn't readable by all. For instance:
private static final HttpDataFactory factory = new DefaultHttpDataFactory();
factory.setBaseDir('/tmp/private');

 [ CVE-2023-34462 ] io.netty:netty-handler 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The SniHandler can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the SniHandler to allocate 16MB of heap. The SniHandler class is a handler that waits for the TLS handshake to configure a SslHandler according to the indicated server name by the ClientHello record. For this matter it allocates a ByteBuf using the value defined in the ClientHello record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the SslClientHelloHandler. This vulnerability has been fixed in version 4.1.94.Final.

 [ CVE-2022-24823 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven framework for developing client and server Java applications.
Netty's io.netty:netty-codec-http package offers multipart decoders (HttpPostMultipartRequestDecoder) for handling HTTP POST requests whose BODY data requires splitting the request to several requests, i.e. in case multiple files are uploaded or when mixed data types are uploaded.
In Netty prior to 4.1.77.Final, local information disclosure may occur when file uploads are stored on the disk, since they're created in the shared system temporary directory, using world-readable permissions. For files to be stored on the disk, the uploaded file size must exceed the minSize threshold, which can also be set upon object creation, and defaults to 16KB. Alternatively, files will be stored on the disk if the HttpDataFactory used by HttpPostMultipartRequestDecoder is initialized to always use the disk by setting the useDisk parameter to True.
This vulnerability arises from an incomplete fix to CVE-2021-21290. In order to completely fix the vulnerability, this CVE's patch must be applied together with CVE-2021-21290's patch.
Unix-based operating systems are affected, as well as older versions of Mac OSX and Windows, which share a temporary directory between all users. Additionally, only Netty applications running on Java 6 or lower are affected. Since Java 6 is an extremely old version, this greatly reduces the amount of potentially vulnerable machines.
Remediation:
Development mitigations
Use DefaultHttpDataFactory.setBaseDir to set the directory in which uploaded files are stored to one that isn't readable by all. For instance:
private static final HttpDataFactory factory = new DefaultHttpDataFactory();
factory.setBaseDir('/tmp/private');

Deployment mitigations
Change the configured JVM's java.io.tmpdir to a directory which is not readable by all. For instance:
java -Djava.io.tmpdir=/tmp/private

 [ CVE-2021-4040 ] org.apache.activemq:artemis-core-client 2.5.0

Description:
A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.

 Note:

Frogbot also supports Contextual Analysis, Secret Detection, IaC and SAST Vulnerabilities Scanning. This features are included as part of the JFrog Advanced Security package, which isn't enabled on your system.

🐸 JFrog Frogbot

📦 Vulnerable Dependencies
✍ Summary

SEVERITY
DIRECT DEPENDENCIES
IMPACTED DEPENDENCY
FIXED VERSIONS
CVES

Critical
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.44.Final]
CVE-2019-20444

Critical
org.apache.activemq:artemis-junit:2.5.0
org.apache.activemq:artemis-server 2.5.0
[2.31.2]
CVE-2023-46604

Critical
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.44.Final]
CVE-2019-20445

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
org.apache.activemq:artemis-core-client 2.5.0
[2.19.1]
CVE-2022-23913

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec 4.1.22.Final
[4.1.68.Final]
CVE-2021-37137

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec 4.1.22.Final
[4.1.68.Final]
CVE-2021-37136

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-handler 4.1.22.Final
[4.1.46]
CVE-2020-11612

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.77.Final]
CVE-2022-24823

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.59.Final]
CVE-2021-21290

  Medium
org.apache.activemq:artemis-junit:2.5.0
org.apache.activemq:artemis-server 2.5.0
[2.24.0]
CVE-2022-35278

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.71.Final]
CVE-2021-43797

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-handler 4.1.22.Final
[4.1.94.Final]
CVE-2023-34462

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.108.Final]
CVE-2024-29025

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
org.apache.activemq:artemis-core-client 2.5.0
[2.19.1]
CVE-2021-4040

 🔬 Research Details

 [ CVE-2019-20444 ] io.netty:netty-codec-http 4.1.22.Final

Description:
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

 [ CVE-2023-46604 ] org.apache.activemq:artemis-server 2.5.0

Description:
Apache ActiveMQ is a widely-used open-source message broker written in Java, known for its multi-protocol compatibility. It offers clients the flexibility of choosing from various programming languages and platforms, with support for JavaScript, C, C++, Python, .NET, and others.
Apache ActiveMQ Artemis is a next-generation, high-performance message broker, designed as a successor to the classic Apache ActiveMQ, offering improved performance, scalability, and a more modern architecture for messaging applications.
ActiveMQ can broker multiple protocol formats, such as AMQP, STOMP, MQTT, and OpenWire.
The OpenWire implementation in ActiveMQ was discovered to be vulnerable to a deserialization attack, which may lead to remote code execution by unauthenticated network attackers.
The vulnerability is highly likely to be exploited, since it is exploitable by unauthenticated network attackers, in the default ActiveMQ server configuration, by using a public exploit and with no need for target-specific research.
Successful exploitation requires a class on the classpath to be used as a gadget, which can execute arbitrary code simply by instantiating it with a String parameter.
One of the classes shipped in the classic ActiveMQ is org.springframework.context.support.ClassPathXmlApplicationContext.
The purpose of ClassPathXmlApplicationContext is to retrieve an XML application configuration file via HTTP from a remote location on the network, which is used in the published PoCs to execute arbitrary code.
The Artemis versions also support the OpenWire protocol but does not ship with this gadget class, so exploitation of Artemis has not yet been proven.
The OpenWire transport is enabled by default and listens on TCP port 61616.
Remediation:
Deployment mitigations
You can switch from using the vulnerable OpenWire protocol to another protocol (and adjust the MQTT clients accordingly).
On ActiveMQ (the default Classic project):
In the configuration file activemq.xml change the transport connector to one of the following - AMQP / MQTT / STOMP / Websockets.
An example of a vulnerable transport connector:
<transportConnector name="tcp" uri="tcp://<IP_ADDRESS>:61616"/>

An example of non-vulnerable transport connectors:
<transportConnector name="amqp" uri="amqp://<IP_ADDRESS>:5672"/>
<transportConnector name="stomp" uri="stomp://<IP_ADDRESS>:61613"/>
<transportConnector name="mqtt" uri="mqtt://<IP_ADDRESS>:1883"/>
<transportConnector name="ws" uri="ws://<IP_ADDRESS>:61614"/>

On ActiveMQ Artemis:
In the configuration file broker.xml change the protocol to one of the following - CORE / AMQP / MQTT / STOMP.
Example of a vulnerable configuration where all protocols are enabled including OpenWire:
<acceptors>
   <acceptor>tcp://localhost:61616</acceptor>
</acceptors>

Example of a vulnerable configuration where the protocol OpenWire is specified:
<acceptors>
   <acceptor>tcp://localhost:61616?protocols=OPENWIRE</acceptor>
</acceptors>

Example of a not-vulnerable configuration using MQTT:
<acceptors>
   <acceptor>tcp://localhost:61616?protocols=MQTT</acceptor>
</acceptors>

 [ CVE-2019-20445 ] io.netty:netty-codec-http 4.1.22.Final

Description:
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

 [ CVE-2022-23913 ] org.apache.activemq:artemis-core-client 2.5.0

Description:
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

 [ CVE-2021-37137 ] io.netty:netty-codec 4.1.22.Final

Description:
netty is a popular client/server framework which enables quick and easy development of network applications such as protocol servers and clients.
A vulnerability was found in netty's Snappy decoder - when using the netty library and accepting arbitrary data streams to decode, netty does not limit the stream in any way.
An attacker that can submit a big file to decompress, may cause memory exhaustion which will lead to denial of service on the netty daemon process and possibly other processes on the same machine.
Example code that can trigger the issue -
public static void main(String[] args) throws Exception {
    SnappyFrameDecoder decoder = new SnappyFrameDecoder(); // Create the decompressor
    final ByteBufAllocator allocator = new PooledByteBufAllocator(false);
    FileInputStream file = new FileInputStream("C:\\temp\\100GB.snappy"); // External input
    int inputChunks = 64 * 1024;
    ByteBuf buf = allocator.heapBuffer(inputChunks);
    ChannelHandlerContext ctx = new StubChannelHandlerContext(allocator);
    while (buf.writeBytes(file, buf.writableBytes()) >= 0) {
        System.out.println("Input: " + buf.capacity());
        decoder.channelRead(ctx, buf); // BUG, No internal resource release!
        buf = allocator.heapBuffer(inputChunks);
        decoder.channelReadComplete(ctx);
}

 [ CVE-2021-37136 ] io.netty:netty-codec 4.1.22.Final

Description:
netty is a popular client/server framework which enables quick and easy development of network applications such as protocol servers and clients.
A vulnerability was found in netty's Bzip2 decoder - when using the netty library and accepting arbitrary data streams to decode, netty does not limit the stream in any way.
An attacker that can submit a big file to decompress, may cause memory exhaustion which will lead to denial of service on the netty daemon process and possibly other processes on the same machine.
Example code that can trigger the issue -
public static void main(String[] args) throws Exception {
    Bzip2Decoder decoder = new Bzip2Decoder(); // Create the decompressor
    final ByteBufAllocator allocator = new PooledByteBufAllocator(false);
    FileInputStream file = new FileInputStream("C:\\temp\\100GB.bz2"); // External input
    int inputChunks = 64 * 1024;
    ByteBuf buf = allocator.heapBuffer(inputChunks);
    ChannelHandlerContext ctx = new StubChannelHandlerContext(allocator);
    while (buf.writeBytes(file, buf.writableBytes()) >= 0) {
        System.out.println("Input: " + buf.capacity());
        decoder.channelRead(ctx, buf); // BUG, No internal resource release!
        buf = allocator.heapBuffer(inputChunks);
        decoder.channelReadComplete(ctx);
}

 [ CVE-2020-11612 ] io.netty:netty-handler 4.1.22.Final

Description:
Java applications that use the Netty network framework and specifically decompressing attacker-supplied data using the ZlibDecoder, JdkZlibDecoder and JZlibDecoder classes could be vulnerable to memory exhaustion and DoS (denial of service).
In addition, Java applications that use the Netty HTTP package could be vulnerable as well as it could use the vulnerable classes indirectly when handling compressed content (for example here in the HttpContentDecompressor class).
This vulnerability originates from the fact that it isn't generally possible to pre-determine the memory needed when decompressing a stream compressed using DEFLATE (the data compression file format used by all of the classes above) and that none of the decompression classes above enforce or allow the developer using them to enforce the size limit for the decompressed buffer.
If the stream is provided from untrusted input, an attacker which is able to supply data that was compressed using one of the vulnerable codecs to a Netty-based application, could cause it to run out of memory, leading to the application halting or crashing and a DoS.
The patch introduced in version 4.1.46 allows limiting the decompressed buffer to a configurable size.
Remediation:
Deployment mitigations
If possible, avoid using Netty's ZlibDecoder for decompressing user input. Consider using other libraries such as java.util.zip

 [ CVE-2022-24823 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven framework for developing client and server Java applications.
Netty's io.netty:netty-codec-http package offers multipart decoders (HttpPostMultipartRequestDecoder) for handling HTTP POST requests whose BODY data requires splitting the request to several requests, i.e. in case multiple files are uploaded or when mixed data types are uploaded.
In Netty prior to 4.1.77.Final, local information disclosure may occur when file uploads are stored on the disk, since they're created in the shared system temporary directory, using world-readable permissions. For files to be stored on the disk, the uploaded file size must exceed the minSize threshold, which can also be set upon object creation, and defaults to 16KB. Alternatively, files will be stored on the disk if the HttpDataFactory used by HttpPostMultipartRequestDecoder is initialized to always use the disk by setting the useDisk parameter to True.
This vulnerability arises from an incomplete fix to CVE-2021-21290. In order to completely fix the vulnerability, this CVE's patch must be applied together with CVE-2021-21290's patch.
Unix-based operating systems are affected, as well as older versions of Mac OSX and Windows, which share a temporary directory between all users. Additionally, only Netty applications running on Java 6 or lower are affected. Since Java 6 is an extremely old version, this greatly reduces the amount of potentially vulnerable machines.
Remediation:
Development mitigations
Use DefaultHttpDataFactory.setBaseDir to set the directory in which uploaded files are stored to one that isn't readable by all. For instance:
private static final HttpDataFactory factory = new DefaultHttpDataFactory();
factory.setBaseDir('/tmp/private');

Deployment mitigations
Change the configured JVM's java.io.tmpdir to a directory which is not readable by all. For instance:
java -Djava.io.tmpdir=/tmp/private

 [ CVE-2021-21290 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven framework for developing client and server Java applications.
Netty's io.netty:netty-codec-http package offers multipart decoders (HttpPostMultipartRequestDecoder) for handling HTTP POST requests whose BODY data requires splitting the request to several requests, i.e. in case multiple files are uploaded or when mixed data types are uploaded.
In Netty prior to 4.1.77.Final, local information disclosure may occur when file uploads are stored on the disk, since they're created in the shared system temporary directory, using world-readable permissions. For files to be stored on the disk, the uploaded file size must exceed the minSize threshold, which can also be set upon object creation, and defaults to 16KB. Alternatively, files will be stored on the disk if the HttpDataFactory used by HttpPostMultipartRequestDecoder is initialized to always use the disk by setting the useDisk parameter to True.
This vulnerability's fix is incomplete. In order to completely fix the vulnerability, this CVE's patch must be applied together with CVE-2022-24823's patch.
Unix-based operating systems are affected, as well as older versions of macOS and Windows, which share a temporary directory between all users. Additionally, only Netty applications running on Java 6 or lower are affected. Since Java 6 is an extremely old version, this greatly reduces the amount of potentially vulnerable machines.
Remediation:
Deployment mitigations
Change the configured JVM's java.io.tmpdir to a directory which is not readable by all. For instance:
java -Djava.io.tmpdir=/tmp/private

Development mitigations
Use DefaultHttpDataFactory.setBaseDir to set the directory in which uploaded files are stored to one that isn't readable by all. For instance:
private static final HttpDataFactory factory = new DefaultHttpDataFactory();
factory.setBaseDir('/tmp/private');

 [ CVE-2022-35278 ] org.apache.activemq:artemis-server 2.5.0

Description:
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

 [ CVE-2021-43797 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

 [ CVE-2023-34462 ] io.netty:netty-handler 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The SniHandler can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the SniHandler to allocate 16MB of heap. The SniHandler class is a handler that waits for the TLS handshake to configure a SslHandler according to the indicated server name by the ClientHello record. For this matter it allocates a ByteBuf using the value defined in the ClientHello record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the SslClientHelloHandler. This vulnerability has been fixed in version 4.1.94.Final.

 [ CVE-2024-29025 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

 [ CVE-2021-4040 ] org.apache.activemq:artemis-core-client 2.5.0

Description:
A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.

 Note:

Frogbot also supports Contextual Analysis, Secret Detection, IaC and SAST Vulnerabilities Scanning. This features are included as part of the JFrog Advanced Security package, which isn't enabled on your system.

🐸 JFrog Frogbot

:x: Build failed in 47m 9s
Build command:
mvn clean verify -B -e -Daudit -Djs.no.sandbox

:no_entry: Failed Tests
:cloud_with_lightning_and_rain: 135 test(s) failed:
org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow12 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_InlinedStrings_Streaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSX (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSXStream (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_Header_StartRow0 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_Header_StartRowX (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_InlinedStrings_NoStreaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_InlinedStrings_Streaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow0 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow5 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_NoHeader_StartRow0 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_NoHeader_StartRowX (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSXCompressionRatioIsBig (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_SharedStrings_Streaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_InlinedStrings_NoStreaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_SharedStrings_Streaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_SharedStrings_NoStreaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_SharedStrings_NoStreaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow0 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow5 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow12 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testNullDateCell (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadCells (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadRowRA (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadData (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadSameRow (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadEmptyRow (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testInlineString (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testNoUsedRangeSpecified (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testCreateFolder (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testNullsEmptyStr (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testDataValidationExtension (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testWriteStreamingTemplate (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testWriteStreamingTemplateOutFields (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testNullsBlank (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testWriteUsingTemplateWithFormatting (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueString (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBigNumber (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_Stream_NoTemplate (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueInteger (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueInternetAddress (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueDate (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_NoStream_Template (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_NoStream_NoTemplate (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueTimestamp (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_Stream_Template (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBinary (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBoolean (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testPrepareNextOutputFile (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueNumber (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsCleared (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsSet (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsNotSet (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_StyleFormatTest.testStyleFormatXssf (click to expand)
Factory

org.pentaho.di.core.xml.XMLHandlerUnitTest.addTagValueBinary (click to expand)
expected:<...ytedata>H4sIAAAAAAAA[/w]tJLS5RcEksSQQAL4PL8Q...> but was:<...ytedata>H4sIAAAAAAAA[AA]tJLS5RcEksSQQAL4PL8Q...>

org.pentaho.ui.database.event.FragmentHandlerTest.org.pentaho.ui.database.event.FragmentHandlerTest (click to expand)
No more handles [gtk_init_check() failed]

org.pentaho.di.trans.steps.fieldsplitter.FieldSplitterTest.testSplitFields (click to expand)
Output row is of an unexpected length expected:<4> but was:<3>

org.pentaho.di.trans.steps.aggregaterows.AggregateRowsTest.testProcessRow (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.creditcardvalidator.CreditCardValidatorMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.edi2xml.Edi2XmlMetaTest.testStepMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mailinput.MailInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.getrepositorynames.GetRepositoryNamesMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.googleanalytics.GaInputStepMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.gpload.GPLoadMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.infobrightoutput.InfobrightLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputMetaLoadSaveTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNullChangedToFalse_NoNullInOutput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSingleObjPred (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExpressionWithLegacyModeEnable (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildDot (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildBracketsNDots (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExpMismatchError (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBfsMatchOrder (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNullTrue_NullsInOutput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExpressionWithLegacyModeDisable (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBadInput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testAttrFilter (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndex (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullProp (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputPathResolutionSuccess (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testObjectOut (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSmallDoubles (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testChildBrackets (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testArrayOut (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRemoveSourceField (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRepeatFieldSingleObj (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testZeroSizeFile (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testUrlInput (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBicycleAsterisk (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexList (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testFileList (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExtraFileFields (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexFirst (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testZipFileInput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNoFilesInListError (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullFileList (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testErrorRedirect (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIncludeNulls_N (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIncludeNulls_Y (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNull (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testLargeDoubles (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJgdArray (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testParsingWithNullFinding (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testRowLimit (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExpMismatchPathLeafToNull (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testNullInputs (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBadExp (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIndexLastObj (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputPathResolution (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDualExp (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testIfIgnorePathDoNotSkipRowIfInputIsNullOrFieldNotFound (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSingleField (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testJsonInputMetaInputFieldsNotOverwritten (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testPathMissingIgnore (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testBracketEscape (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.ldapinput.LDAPInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.ldapoutput.LDAPOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mailvalidator.MailValidatorMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mondrianinput.MondrianInputMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.accessinput.AccessInputMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.accessoutput.AccessOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mysqlbulkloader.MySQLBulkLoaderMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.orabulkloader.OraBulkLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.pgbulkloader.PGBulkLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.randomccnumber.RandomCCNumberGeneratorMetaTest.testStepMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.rssinput.RssInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.rssoutput.RssOutputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforcedelete.SalesforceDeleteMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceinput.SalesforceInputMetaTest.testSalesforceInputMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceinsert.SalesforceInsertMetaTest.testSalesforceInsertMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceupdate.SalesforceUpdateMetaTest.testSalesforceUpdateMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.salesforceupsert.SalesforceUpsertMetaTest.testSalesforceUpsertMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.shapefilereader.ShapeFileReaderTest.processRowPolyLineCloneRowTest (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.shapefilereader.ShapeFileReaderTest.processRowPolyLineCloneRowTest (click to expand)
${result.errorDetails}

org.pentaho.di.trans.steps.yamlinput.YamlInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

Tests run: 5408, Failures: 135, Skipped: 23    Test Results

:information_source:  This is an automatic message

📦 Vulnerable Dependencies
✍ Summary

SEVERITY
DIRECT DEPENDENCIES
IMPACTED DEPENDENCY
FIXED VERSIONS
CVES

Critical
org.apache.activemq:artemis-junit:2.5.0
org.apache.activemq:artemis-server 2.5.0
[2.31.2]
CVE-2023-46604

Critical
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.44.Final]
CVE-2019-20444

Critical
org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOTorg.apache.activemq:artemis-jms-client-osgi:2.5.0
io.netty:netty-codec-http 4.1.22.Final
[4.1.44.Final]
CVE-2019-20445

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec 4.1.22.Final
[4.1.68.Final]
CVE-2021-37136

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec 4.1.22.Final
[4.1.68.Final]
CVE-2021-37137

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
org.apache.activemq:artemis-core-client 2.5.0
[2.19.1]
CVE-2022-23913

    High
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-handler 4.1.22.Final
[4.1.46]
CVE-2020-11612

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
org.apache.activemq:artemis-core-client 2.5.0
[2.19.1]
CVE-2021-4040

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.77.Final]
CVE-2022-24823

  Medium
org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOTorg.apache.activemq:artemis-jms-client-osgi:2.5.0
io.netty:netty-codec-http 4.1.22.Final
[4.1.108.Final]
CVE-2024-29025

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.71.Final]
CVE-2021-43797

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-handler 4.1.22.Final
[4.1.94.Final]
CVE-2023-34462

  Medium
org.apache.activemq:artemis-jms-client-osgi:2.5.0org.pentaho.di.plugins:pentaho-streaming-jms-plugin:<IP_ADDRESS>-SNAPSHOT
io.netty:netty-codec-http 4.1.22.Final
[4.1.59.Final]
CVE-2021-21290

  Medium
org.apache.activemq:artemis-junit:2.5.0
org.apache.activemq:artemis-server 2.5.0
[2.24.0]
CVE-2022-35278

 🔬 Research Details

 [ CVE-2023-46604 ] org.apache.activemq:artemis-server 2.5.0

Description:
Apache ActiveMQ is a widely-used open-source message broker written in Java, known for its multi-protocol compatibility. It offers clients the flexibility of choosing from various programming languages and platforms, with support for JavaScript, C, C++, Python, .NET, and others.
Apache ActiveMQ Artemis is a next-generation, high-performance message broker, designed as a successor to the classic Apache ActiveMQ, offering improved performance, scalability, and a more modern architecture for messaging applications.
ActiveMQ can broker multiple protocol formats, such as AMQP, STOMP, MQTT, and OpenWire.
The OpenWire implementation in ActiveMQ was discovered to be vulnerable to a deserialization attack, which may lead to remote code execution by unauthenticated network attackers.
The vulnerability is highly likely to be exploited, since it is exploitable by unauthenticated network attackers, in the default ActiveMQ server configuration, by using a public exploit and with no need for target-specific research.
Successful exploitation requires a class on the classpath to be used as a gadget, which can execute arbitrary code simply by instantiating it with a String parameter.
One of the classes shipped in the classic ActiveMQ is org.springframework.context.support.ClassPathXmlApplicationContext.
The purpose of ClassPathXmlApplicationContext is to retrieve an XML application configuration file via HTTP from a remote location on the network, which is used in the published PoCs to execute arbitrary code.
The Artemis versions also support the OpenWire protocol but does not ship with this gadget class, so exploitation of Artemis has not yet been proven.
The OpenWire transport is enabled by default and listens on TCP port 61616.
Remediation:
Deployment mitigations
You can switch from using the vulnerable OpenWire protocol to another protocol (and adjust the MQTT clients accordingly).
On ActiveMQ (the default Classic project):
In the configuration file activemq.xml change the transport connector to one of the following - AMQP / MQTT / STOMP / Websockets.
An example of a vulnerable transport connector:
<transportConnector name="tcp" uri="tcp://<IP_ADDRESS>:61616"/>

An example of non-vulnerable transport connectors:
<transportConnector name="amqp" uri="amqp://<IP_ADDRESS>:5672"/>
<transportConnector name="stomp" uri="stomp://<IP_ADDRESS>:61613"/>
<transportConnector name="mqtt" uri="mqtt://<IP_ADDRESS>:1883"/>
<transportConnector name="ws" uri="ws://<IP_ADDRESS>:61614"/>

On ActiveMQ Artemis:
In the configuration file broker.xml change the protocol to one of the following - CORE / AMQP / MQTT / STOMP.
Example of a vulnerable configuration where all protocols are enabled including OpenWire:
<acceptors>
   <acceptor>tcp://localhost:61616</acceptor>
</acceptors>

Example of a vulnerable configuration where the protocol OpenWire is specified:
<acceptors>
   <acceptor>tcp://localhost:61616?protocols=OPENWIRE</acceptor>
</acceptors>

Example of a not-vulnerable configuration using MQTT:
<acceptors>
   <acceptor>tcp://localhost:61616?protocols=MQTT</acceptor>
</acceptors>

 [ CVE-2019-20444 ] io.netty:netty-codec-http 4.1.22.Final

Description:
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

 [ CVE-2019-20445 ] io.netty:netty-codec-http 4.1.22.Final

Description:
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

 [ CVE-2021-37136 ] io.netty:netty-codec 4.1.22.Final

Description:
netty is a popular client/server framework which enables quick and easy development of network applications such as protocol servers and clients.
A vulnerability was found in netty's Bzip2 decoder - when using the netty library and accepting arbitrary data streams to decode, netty does not limit the stream in any way.
An attacker that can submit a big file to decompress, may cause memory exhaustion which will lead to denial of service on the netty daemon process and possibly other processes on the same machine.
Example code that can trigger the issue -
public static void main(String[] args) throws Exception {
    Bzip2Decoder decoder = new Bzip2Decoder(); // Create the decompressor
    final ByteBufAllocator allocator = new PooledByteBufAllocator(false);
    FileInputStream file = new FileInputStream("C:\\temp\\100GB.bz2"); // External input
    int inputChunks = 64 * 1024;
    ByteBuf buf = allocator.heapBuffer(inputChunks);
    ChannelHandlerContext ctx = new StubChannelHandlerContext(allocator);
    while (buf.writeBytes(file, buf.writableBytes()) >= 0) {
        System.out.println("Input: " + buf.capacity());
        decoder.channelRead(ctx, buf); // BUG, No internal resource release!
        buf = allocator.heapBuffer(inputChunks);
        decoder.channelReadComplete(ctx);
}

 [ CVE-2021-37137 ] io.netty:netty-codec 4.1.22.Final

Description:
netty is a popular client/server framework which enables quick and easy development of network applications such as protocol servers and clients.
A vulnerability was found in netty's Snappy decoder - when using the netty library and accepting arbitrary data streams to decode, netty does not limit the stream in any way.
An attacker that can submit a big file to decompress, may cause memory exhaustion which will lead to denial of service on the netty daemon process and possibly other processes on the same machine.
Example code that can trigger the issue -
public static void main(String[] args) throws Exception {
    SnappyFrameDecoder decoder = new SnappyFrameDecoder(); // Create the decompressor
    final ByteBufAllocator allocator = new PooledByteBufAllocator(false);
    FileInputStream file = new FileInputStream("C:\\temp\\100GB.snappy"); // External input
    int inputChunks = 64 * 1024;
    ByteBuf buf = allocator.heapBuffer(inputChunks);
    ChannelHandlerContext ctx = new StubChannelHandlerContext(allocator);
    while (buf.writeBytes(file, buf.writableBytes()) >= 0) {
        System.out.println("Input: " + buf.capacity());
        decoder.channelRead(ctx, buf); // BUG, No internal resource release!
        buf = allocator.heapBuffer(inputChunks);
        decoder.channelReadComplete(ctx);
}

 [ CVE-2022-23913 ] org.apache.activemq:artemis-core-client 2.5.0

Description:
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.

 [ CVE-2020-11612 ] io.netty:netty-handler 4.1.22.Final

Description:
Java applications that use the Netty network framework and specifically decompressing attacker-supplied data using the ZlibDecoder, JdkZlibDecoder and JZlibDecoder classes could be vulnerable to memory exhaustion and DoS (denial of service).
In addition, Java applications that use the Netty HTTP package could be vulnerable as well as it could use the vulnerable classes indirectly when handling compressed content (for example here in the HttpContentDecompressor class).
This vulnerability originates from the fact that it isn't generally possible to pre-determine the memory needed when decompressing a stream compressed using DEFLATE (the data compression file format used by all of the classes above) and that none of the decompression classes above enforce or allow the developer using them to enforce the size limit for the decompressed buffer.
If the stream is provided from untrusted input, an attacker which is able to supply data that was compressed using one of the vulnerable codecs to a Netty-based application, could cause it to run out of memory, leading to the application halting or crashing and a DoS.
The patch introduced in version 4.1.46 allows limiting the decompressed buffer to a configurable size.
Remediation:
Deployment mitigations
If possible, avoid using Netty's ZlibDecoder for decompressing user input. Consider using other libraries such as java.util.zip

 [ CVE-2021-4040 ] org.apache.activemq:artemis-core-client 2.5.0

Description:
A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.

 [ CVE-2022-24823 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven framework for developing client and server Java applications.
Netty's io.netty:netty-codec-http package offers multipart decoders (HttpPostMultipartRequestDecoder) for handling HTTP POST requests whose BODY data requires splitting the request to several requests, i.e. in case multiple files are uploaded or when mixed data types are uploaded.
In Netty prior to 4.1.77.Final, local information disclosure may occur when file uploads are stored on the disk, since they're created in the shared system temporary directory, using world-readable permissions. For files to be stored on the disk, the uploaded file size must exceed the minSize threshold, which can also be set upon object creation, and defaults to 16KB. Alternatively, files will be stored on the disk if the HttpDataFactory used by HttpPostMultipartRequestDecoder is initialized to always use the disk by setting the useDisk parameter to True.
This vulnerability arises from an incomplete fix to CVE-2021-21290. In order to completely fix the vulnerability, this CVE's patch must be applied together with CVE-2021-21290's patch.
Unix-based operating systems are affected, as well as older versions of Mac OSX and Windows, which share a temporary directory between all users. Additionally, only Netty applications running on Java 6 or lower are affected. Since Java 6 is an extremely old version, this greatly reduces the amount of potentially vulnerable machines.
Remediation:
Development mitigations
Use DefaultHttpDataFactory.setBaseDir to set the directory in which uploaded files are stored to one that isn't readable by all. For instance:
private static final HttpDataFactory factory = new DefaultHttpDataFactory();
factory.setBaseDir('/tmp/private');

Deployment mitigations
Change the configured JVM's java.io.tmpdir to a directory which is not readable by all. For instance:
java -Djava.io.tmpdir=/tmp/private

 [ CVE-2024-29025 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, this field can cumulate data without limits. This vulnerability is fixed in 4.1.108.Final.

 [ CVE-2021-43797 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

 [ CVE-2023-34462 ] io.netty:netty-handler 4.1.22.Final

Description:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The SniHandler can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the SniHandler to allocate 16MB of heap. The SniHandler class is a handler that waits for the TLS handshake to configure a SslHandler according to the indicated server name by the ClientHello record. For this matter it allocates a ByteBuf using the value defined in the ClientHello record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the SslClientHelloHandler. This vulnerability has been fixed in version 4.1.94.Final.

 [ CVE-2021-21290 ] io.netty:netty-codec-http 4.1.22.Final

Description:
Netty is an asynchronous event-driven framework for developing client and server Java applications.
Netty's io.netty:netty-codec-http package offers multipart decoders (HttpPostMultipartRequestDecoder) for handling HTTP POST requests whose BODY data requires splitting the request to several requests, i.e. in case multiple files are uploaded or when mixed data types are uploaded.
In Netty prior to 4.1.77.Final, local information disclosure may occur when file uploads are stored on the disk, since they're created in the shared system temporary directory, using world-readable permissions. For files to be stored on the disk, the uploaded file size must exceed the minSize threshold, which can also be set upon object creation, and defaults to 16KB. Alternatively, files will be stored on the disk if the HttpDataFactory used by HttpPostMultipartRequestDecoder is initialized to always use the disk by setting the useDisk parameter to True.
This vulnerability's fix is incomplete. In order to completely fix the vulnerability, this CVE's patch must be applied together with CVE-2022-24823's patch.
Unix-based operating systems are affected, as well as older versions of macOS and Windows, which share a temporary directory between all users. Additionally, only Netty applications running on Java 6 or lower are affected. Since Java 6 is an extremely old version, this greatly reduces the amount of potentially vulnerable machines.
Remediation:
Deployment mitigations
Change the configured JVM's java.io.tmpdir to a directory which is not readable by all. For instance:
java -Djava.io.tmpdir=/tmp/private

Development mitigations
Use DefaultHttpDataFactory.setBaseDir to set the directory in which uploaded files are stored to one that isn't readable by all. For instance:
private static final HttpDataFactory factory = new DefaultHttpDataFactory();
factory.setBaseDir('/tmp/private');

 [ CVE-2022-35278 ] org.apache.activemq:artemis-server 2.5.0

Description:
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.

 Note:

Frogbot also supports Contextual Analysis, Secret Detection, IaC and SAST Vulnerabilities Scanning. This features are included as part of the JFrog Advanced Security package, which isn't enabled on your system.

🐸 JFrog Frogbot

:x: Build failed in 40m 19s
Build command:
mvn clean verify -B -e -Daudit -Djs.no.sandbox

:no_entry: Failed Tests
:cloud_with_lightning_and_rain: 135 test(s) failed:
org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow12 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_InlinedStrings_Streaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSX (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSXStream (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_Header_StartRow0 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_Header_StartRowX (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_InlinedStrings_NoStreaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_InlinedStrings_Streaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow0 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow5 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_NoHeader_StartRow0 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_MultipleSheets_NoHeader_StartRowX (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testXLSXCompressionRatioIsBig (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_SharedStrings_Streaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_InlinedStrings_NoStreaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_SharedStrings_Streaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_NoHeader_SharedStrings_NoStreaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.testReadBlankAndNullCells_XSLSX_Header_SharedStrings_NoStreaming (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow0 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_NoHeader_StartRow5 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.ExcelInputContentParsingTest.test_PDI_17765_SingleSheet_Header_StartRow12 (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testNullDateCell (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadCells (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadRowRA (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadData (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadSameRow (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testReadEmptyRow (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testInlineString (click to expand)
Factory

org.pentaho.di.trans.steps.excelinput.staxpoi.StaxPoiSheetTest.testNoUsedRangeSpecified (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testCreateFolder (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testNullsEmptyStr (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testDataValidationExtension (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testWriteStreamingTemplate (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testWriteStreamingTemplateOutFields (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterFullTest.testNullsBlank (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testWriteUsingTemplateWithFormatting (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueString (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBigNumber (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_Stream_NoTemplate (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueInteger (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueInternetAddress (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueDate (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_NoStream_Template (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_NoStream_NoTemplate (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueTimestamp (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.test_Xlsx_Stream_Template (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBinary (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueBoolean (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testPrepareNextOutputFile (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStepTest.testValueNumber (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsCleared (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsSet (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_FormulaRecalculationTest.forcesToRecalculate_Sxssf_PropertyIsNotSet (click to expand)
Factory

org.pentaho.di.trans.steps.excelwriter.ExcelWriterStep_StyleFormatTest.testStyleFormatXssf (click to expand)
Factory

org.pentaho.di.core.xml.XMLHandlerUnitTest.addTagValueBinary (click to expand)
expected:<...ytedata>H4sIAAAAAAAA[/w]tJLS5RcEksSQQAL4PL8Q...> but was:<...ytedata>H4sIAAAAAAAA[AA]tJLS5RcEksSQQAL4PL8Q...>

org.pentaho.ui.database.event.FragmentHandlerTest.org.pentaho.ui.database.event.FragmentHandlerTest (click to expand)
No more handles [gtk_init_check() failed]

org.pentaho.di.trans.steps.fieldsplitter.FieldSplitterTest.testSplitFields (click to expand)
Output row is of an unexpected length expected:<4> but was:<3>

org.pentaho.di.trans.steps.aggregaterows.AggregateRowsTest.testProcessRow (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.creditcardvalidator.CreditCardValidatorMetaTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.edi2xml.Edi2XmlMetaTest.testStepMeta (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.mailinput.MailInputMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.getrepositorynames.GetRepositoryNamesMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.googleanalytics.GaInputStepMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.gpload.GPLoadMetaTest.testRoundTrip (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.infobrightoutput.InfobrightLoaderMetaTest.testSerialization (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputMetaLoadSaveTest.testLoadSave (click to expand)
'org.mockito.stubbing.LenientStubber org.mockito.Mockito.lenient()'

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testDefaultLeafToNullChangedToFalse_NoNullInOutput (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testSingleObjPred (click to expand)
org/mockito/ArgumentMatchers

org.pentaho.di.trans.steps.jsoninput.JsonInputTest.testExpressionWithLegacyModeEnable (click to expand)