Skip to content

Fix transitive CVE vulnerabilities in dependency tree - AST-142710#339

Open
cx-anand-nandeshwar wants to merge 7 commits into
mainfrom
vulnerability/spring_security_AST-142710
Open

Fix transitive CVE vulnerabilities in dependency tree - AST-142710#339
cx-anand-nandeshwar wants to merge 7 commits into
mainfrom
vulnerability/spring_security_AST-142710

Conversation

@cx-anand-nandeshwar
Copy link
Copy Markdown

@cx-anand-nandeshwar cx-anand-nandeshwar commented Apr 7, 2026 •
edited
Loading

Summary

Fixes three transitive CVE vulnerabilities introduced through TeamCity SDK dependencies (server-api, web-openapi, common-jackson, common-spring-security). All fixes follow a defense-in-depth approach: version pinning in dependencyManagement (forces the safe resolved version) plus exclusions at every TeamCity entry point (removes the vulnerable path from the declared artifact graph so scanners that walk POM metadata also see a clean tree).

CVE 1 — spring-security-web HTTP security-header bypass (CVE-2026-22732)

https://checkmarx.atlassian.net/browse/AST-142710
Vulnerable path server-api → web-openapi → common-spring-security → spring-security-oauth2 → spring-security-web @ 6.3.5
Impact HTTP response security headers silently not written for servlet applications
Affected spring-security-web ≤ 6.5.8 and 7.x ≤ 7.0.3
Fix springSecurity.version = 6.5.9; exclude EOL spring-security-oauth2 from server-api, server-web-api, tests-support

CVE 2 — jackson-core async parser DoS

https://checkmarx.atlassian.net/browse/AST-140246
Vulnerable path server-api → web-openapi → common-jackson → jackson-datatype-jdk8 → jackson-core @ 2.19.0
Impact Non-blocking async parser ignores maxNumberLength → unbounded memory/CPU → DoS
Affected jackson-core < 2.18.6 / < 2.19.1 / < 3.1.0
Fix jackson.version = 2.21.1 pinned for all jackson-* artifacts in dependencyManagement; exclude common-jackson from server-api, server-web-api, tests-support

CVE 3 — commons-lang3 uncontrolled recursion DoS
Vulnerable path server-api → commons-text @ 1.13.1 → commons-lang3 @ 3.17.0
Impact ClassUtils.getClass() recurses unboundedly on crafted long inputs → StackOverflowError → application crash (DoS)
Affected commons-lang3 3.0 – 3.17.0
Fix Upgrade commons-text → 1.15.0 (natively declares commons-lang3 @ 3.20.0, removing the vulnerable path from the artifact's own POM metadata); pin commons-lang3.version = 3.20.0 independently in dependencyManagement

Why both layers? Version pinning fixes the resolved version (what Maven puts on the classpath). Exclusions and artifact upgrades fix the declared version (what lives in the artifact POM on Maven Central). Scanners such as Snyk, OWASP Dependency Check, and GitHub Dependabot walk the declared graph — both layers are required for a clean result.

Files changed

File Changes
pom.xml Added jackson.version, commons-lang3.version, commons-text.version properties; pinned all jackson-*, commons-text, commons-lang3 in dependencyManagement; added common-jackson + spring-security-oauth2 exclusions to managed server-api
checkmarx-ast-teamcity-plugin-server/pom.xml Added spring-security-oauth2 + common-jackson exclusions to server-api, server-web-api, and tests-support direct declarations
checkmarx-ast-teamcity-plugin-common/pom.xml Aligned commons-lang3 direct declaration to use ${commons-lang3.version} property instead of a hardcoded version

Test plan

  • Run mvn dependency:tree and confirm no spring-security-web, jackson-core, or commons-lang3 below the fix versions appear in the resolved tree
  • Run mvn clean package — build must succeed with no compilation errors
  • Re-run the security scanner and confirm zero findings for all three CVE paths
  • Deploy the plugin to a TeamCity instance and verify server startup and plugin functionality are unaffected

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 7, 2026 •
edited
Loading

Logo
Checkmarx One – Scan Summary & Details – 332e197e-0c67-4f94-9b6c-0e5c2cb787f9

Fixed Issues (2) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
CRITICAL CVE-2026-22732 Maven-org.springframework.security:spring-security-web-6.3.5
HIGH Cxfa47c4e4-5ef9 Maven-com.fasterxml.jackson.core:jackson-core-2.19.0

@cx-anand-nandeshwar @claude
Fix transitive CVE vulnerabilities in dependency tree - AST-142710
5b45d39 
Addresses three CVEs introduced via TeamCity transitive dependencies:

1. spring-security-web (CVE-2026-22732)
   - Affected: spring-security-web <= 6.5.8; HTTP response headers not written
   - Fix: pin springSecurity.version=6.5.9 in dependencyManagement
   - Exclude EOL spring-security-oauth2 from server-api, server-web-api,
     tests-support to sever the transitive pull chain at source

2. jackson-core async-parser DoS
   - Affected: jackson-core < 2.19.1; async parser bypasses maxNumberLength
     constraint, enabling unbounded memory/CPU usage (DoS)
   - Fix: pin jackson.version=2.21.1 for all jackson-* artifacts in
     dependencyManagement; exclude common-jackson (TeamCity internal bundle)
     from server-api, server-web-api, tests-support to cut the chain
     web-openapi -> common-jackson -> jackson-datatype-jdk8 -> jackson-core

3. commons-lang3 uncontrolled recursion (StackOverflowError DoS)
   - Affected: commons-lang3 3.0-3.17.0; ClassUtils.getClass() recurses
     unboundedly on crafted long inputs
   - commons-text 1.13.1 declared commons-lang3 @ 3.17.0 in its own POM,
     causing scanners to flag the path even with a managed-version override
   - Fix: upgrade commons-text to 1.15.0 (natively declares commons-lang3
     3.20.0); pin commons-lang3.version=3.20.0 and commons-text.version=1.15.0
     in dependencyManagement so no transitive path can reintroduce an older
     version; align common module direct declaration to use the property

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@cx-anand-nandeshwar cx-anand-nandeshwar changed the title Fixed spring-security-web vulnerability - AST-142710 Fix transitive CVE vulnerabilities in dependency tree - AST-142710 Apr 8, 2026
@cx-anand-nandeshwar
Fix transitive CVE vulnerabilities in dependency tree - AST-142710
1cfebb3 
Addresses three CVEs introduced via TeamCity transitive dependencies:

1. spring-security-web (CVE-2026-22732)
   - Affected: spring-security-web <= 6.5.8; HTTP response headers not written
   - Fix: pin springSecurity.version=6.5.9 in dependencyManagement
   - Exclude EOL spring-security-oauth2 from server-api, server-web-api,
     tests-support to sever the transitive pull chain at source

2. jackson-core async-parser DoS
   - Affected: jackson-core < 2.19.1; async parser bypasses maxNumberLength
     constraint, enabling unbounded memory/CPU usage (DoS)
   - Fix: pin jackson.version=2.21.1 for all jackson-* artifacts in
     dependencyManagement; exclude common-jackson (TeamCity internal bundle)
     from server-api, server-web-api, tests-support to cut the chain
     web-openapi -> common-jackson -> jackson-datatype-jdk8 -> jackson-core

3. commons-lang3 uncontrolled recursion (StackOverflowError DoS)
   - Affected: commons-lang3 3.0-3.17.0; ClassUtils.getClass() recurses
     unboundedly on crafted long inputs
   - commons-text 1.13.1 declared commons-lang3 @ 3.17.0 in its own POM,
     causing scanners to flag the path even with a managed-version override
   - Fix: upgrade commons-text to 1.15.0 (natively declares commons-lang3
     3.20.0); pin commons-lang3.version=3.20.0 and commons-text.version=1.15.0
     in dependencyManagement so no transitive path can reintroduce an older
     version; align common module direct declaration to use the property
@cx-anand-nandeshwar
Merge remote-tracking branch 'origin/vulnerability/spring_security_AS…
8943189 
…T-142710' into vulnerability/spring_security_AST-142710
cx-anurag-dalke
cx-anurag-dalke previously approved these changes Apr 13, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@cx-anurag-dalke cx-anurag-dalke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

@cx-anand-nandeshwar @claude
Fix CI checkout failure caused by missing PERSONAL_ACCESS_TOKEN secret
990b031 
The integration-tests job was failing at the Checkout step with:
  fatal: could not read Username for 'https://github.com': terminal prompts disabled

Root cause: actions/checkout was configured with
  token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
When the PAT secret is absent or expired the token resolves to an
empty string, causing git to prompt for HTTPS credentials which are
disabled on hosted runners.

Fix: use || github.token as a fallback so the runner-injected
GITHUB_TOKEN is used whenever PERSONAL_ACCESS_TOKEN is unavailable.
github.token always has Contents:write for same-org PRs and never
expires, making the checkout reliable regardless of PAT lifecycle.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
cx-anand-nandeshwar and others added 2 commits April 15, 2026 00:07
@cx-anand-nandeshwar @claude
Fix jackson.version: 2.21.1 → 2.21.2 (2.21.1 was never published)
f7e6cef 
The previous CVE fix set jackson.version=2.21.1 which does not exist on
Maven Central, causing the CI build to fail with:
  Could not find artifact jackson-annotations:jar:2.21.1

2.21.2 is the actual latest stable release. Updated the property and
its comment to reflect the correct version.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@cx-anand-nandeshwar @claude
Fix jackson-annotations resolution failure in agent module - AST-142710
7271ce3 
Remove jackson version pins from dependencyManagement (jackson-annotations
does not publish at the same version as jackson-core, causing artifact-not-found
failures). Instead, exclude common-jackson from agent-api and tests-support in
both the root dependencyManagement and agent/pom.xml, eliminating jackson from
the agent module's dependency graph entirely. Also add common-jackson exclusion
to tests-support in root dependencyManagement to close the same gap there.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cx-anurag-dalke cx-anurag-dalke cx-anurag-dalke left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cx-anand-nandeshwar @cx-anurag-dalke