GHSA-fjh6-p566-wr6q skylot jadx affected by Incorrect Behavior Order in vulnerable dependency
Jadx is affected by a vulnerability in its bundled protobuf-java dependency, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is GHSA-fjh6-p566-wr6q?
GHSA-fjh6-p566-wr6q is a vulnerability in io.github.skylot:jadx-core, published on 21 Jul 2022.
Official description
Impact
Vulnerable library protobuf-java 3.11.4 (CVE-2021-22569)
Patches
Dependency updated in jadx 1.4.3
References
According to the AquaSecurity report:
Also, Maven repository have links to this and other vulnerabilities from dependencies: https://mvnrepository.com/artifact/com.google.protobuf/protobuf-java/3.11.4
Which versions are affected by GHSA-fjh6-p566-wr6q?
2 open source packages ship an affected version, including io.github.skylot:jadx-core.
| Package | Affected | Fixed in |
|---|---|---|
io.github.skylot:jadx-core Maven | All versions | 1.4.3 |
io.github.skylot:jadx-core Maven | All versions | 1.4.3 |
How do I fix GHSA-fjh6-p566-wr6q?
Upgrade io.github.skylot:jadx-core to 1.4.3 or later.
Is GHSA-fjh6-p566-wr6q being exploited?
There is no known exploitation of GHSA-fjh6-p566-wr6q in the wild and no public exploit code.