inaccel / coral-api Goto Github PK

Hi, @eliaskoromilas , I'd like to report a vulnerability issue in com.inaccel:coral-api:2.0.0.

Issue Description

com.inaccel:coral-api:2.0.0 directly depends on 1 C library(.so).However, I noticed that the C library is vulnerable, containing the following CVEs:

libcoral-api.so from C project openssl(version:1.1.1) exposed 6 vulnerabilities:
CVE-2021-3711, CVE-2021-3712, CVE-2019-1549, CVE-2019-1543, CVE-2018-0735, CVE-2019-1552

Furthermore, the vulnerable methods in the vulnerable shared libraries can be actually invoked by Java code. For instance, following call chains can reach the vulnerable method(C code) EC_GROUP_new_from_ecparameters() in file crypto/ec/ec_asn1.c reported by CVE-2021-3712.

call chains-----
TS_CONF_set_certs()->TS_CONF_load_certs()->PEM_X509_INFO_read_bio()->d2i_ECPrivateKey()->EC_GROUP_new_from_ecpkparameters()->EC_GROUP_new_from_ecparameters()

Suggested Vulnerability Patch Versions

openssl has fixed the vulnerabilities in versions >=1.1.1l

Java build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Java projects.
Could you please upgrade the above shared libraries to their patch versions?

Thanks for your help~
Best regards,
Helen Parr