fix(deps): Bump the maven group across 8 directories with 4 updates

[dependabot]

Bumps the maven group with 1 update in the /stream-compositions/services directory: org.apache.activemq:activemq-broker.
Bumps the maven group with 1 update in the /stream-compositions/test-utils directory: org.apache.activemq:activemq-broker.
Bumps the maven group with 1 update in the /stream-legal-entity/legal-entity-bootstrap-task directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-legal-entity/legal-entity-http directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-portfolio/portfolio-http directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-product-catalog/product-catalog-task directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 2 updates in the /stream-sdk/stream-parent directory: org.wiremock:wiremock-standalone and org.bouncycastle:bcpkix-jdk18on.
Bumps the maven group with 2 updates in the /stream-sdk/stream-parent/stream-test-support directory: org.wiremock:wiremock-standalone and org.bouncycastle:bcpkix-jdk18on.

Updates org.apache.activemq:activemq-broker from 6.2.4 to 6.2.5

Release notes

Sourced from org.apache.activemq:activemq-broker's releases.

Apache ActiveMQ 6.2.5

What's Changed

• Bump to 6.2.5-SNAPSHOT version by @​jbonofre in apache/activemq#1892
• [6.2.x] SSL handshake write timeout enforcement (#1883) by @​cshannon in apache/activemq#1894
• [6.2.x] Minor bug fix for BrokerView#validateAllowedUri (#1900) by @​cshannon in apache/activemq#1902
• [6.2.x] Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) by @​cshannon in apache/activemq#1915
• compilation-fix by @​cshannon in apache/activemq#1919
• [6.2.x] Make brokerName immutable in RegionBroker (#1917) by @​cshannon in apache/activemq#1923
• [6.2.x] Add Http discovery transport to denied list for JMX (#1918) by @​cshannon in apache/activemq#1925
• [6.2.x] Update resource cleanup on queueBrowse servlet (#1912) by @​cshannon in apache/activemq#1928
• [6.2.x] Update DestinationView uri resolution (#1914) by @​cshannon in apache/activemq#1930
• fix(webconsole): the webconsole now redirect to the slave.jsp when required (slave broker with startAsync="true") [6.2.x] by @​jbonofre in apache/activemq#1934
• [6.2.x] Queue browse improvements in webconsole (#1938) by @​cshannon in apache/activemq#1942
• [6.2.x] Add more transport types to the denied list for JMX (#1949) by @​cshannon in apache/activemq#1952
• [6.2.x] Add remote file filtering for XBeanBrokerFactory (#1950) by @​cshannon in apache/activemq#1954

Full Changelog: apache/activemq@activemq-6.2.4...activemq-6.2.5

Commits

• cfa7998 [maven-release-plugin] prepare release activemq-6.2.5
• 881ce9d Add remote file filtering for XBeanBrokerFactory (#1950) (#1954)
• e19cc3e Add more transport types to the denied list for JMX (#1949) (#1952)
• 0982ba4 Queue browse improvements in webconsole (#1938) (#1942)
• 1dabafb fix(webconsole): the webconsole now redirect to the slave.jsp when required (...
• 2b8455b #1913 Update DestinationView uri resolution (#1914)
• 1b7b1e0 #1911 Update resource cleanup on queueBrowse servlet (#1912)
• 3b3dc08 Add Http discovery transport to denied list for JMX (#1918) (#1925)
• 8c929d0 Make brokerName immutable in RegionBroker (#1917) (#1923)
• eccbe4c compilation-fix (#1919)
• Additional commits viewable in compare view

Updates org.apache.activemq:activemq-broker from 6.2.4 to 6.2.5

Release notes

Sourced from org.apache.activemq:activemq-broker's releases.

Apache ActiveMQ 6.2.5

What's Changed

• Bump to 6.2.5-SNAPSHOT version by @​jbonofre in apache/activemq#1892
• [6.2.x] SSL handshake write timeout enforcement (#1883) by @​cshannon in apache/activemq#1894
• [6.2.x] Minor bug fix for BrokerView#validateAllowedUri (#1900) by @​cshannon in apache/activemq#1902
• [6.2.x] Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) by @​cshannon in apache/activemq#1915
• compilation-fix by @​cshannon in apache/activemq#1919
• [6.2.x] Make brokerName immutable in RegionBroker (#1917) by @​cshannon in apache/activemq#1923
• [6.2.x] Add Http discovery transport to denied list for JMX (#1918) by @​cshannon in apache/activemq#1925
• [6.2.x] Update resource cleanup on queueBrowse servlet (#1912) by @​cshannon in apache/activemq#1928
• [6.2.x] Update DestinationView uri resolution (#1914) by @​cshannon in apache/activemq#1930
• fix(webconsole): the webconsole now redirect to the slave.jsp when required (slave broker with startAsync="true") [6.2.x] by @​jbonofre in apache/activemq#1934
• [6.2.x] Queue browse improvements in webconsole (#1938) by @​cshannon in apache/activemq#1942
• [6.2.x] Add more transport types to the denied list for JMX (#1949) by @​cshannon in apache/activemq#1952
• [6.2.x] Add remote file filtering for XBeanBrokerFactory (#1950) by @​cshannon in apache/activemq#1954

Full Changelog: apache/activemq@activemq-6.2.4...activemq-6.2.5

Commits

• cfa7998 [maven-release-plugin] prepare release activemq-6.2.5
• 881ce9d Add remote file filtering for XBeanBrokerFactory (#1950) (#1954)
• e19cc3e Add more transport types to the denied list for JMX (#1949) (#1952)
• 0982ba4 Queue browse improvements in webconsole (#1938) (#1942)
• 1dabafb fix(webconsole): the webconsole now redirect to the slave.jsp when required (...
• 2b8455b #1913 Update DestinationView uri resolution (#1914)
• 1b7b1e0 #1911 Update resource cleanup on queueBrowse servlet (#1912)
• 3b3dc08 Add Http discovery transport to denied list for JMX (#1918) (#1925)
• 8c929d0 Make brokerName immutable in RegionBroker (#1917) (#1923)
• eccbe4c compilation-fix (#1919)
• Additional commits viewable in compare view

Updates org.apache.activemq:activemq-broker from 6.2.4 to 6.2.5

Release notes

Sourced from org.apache.activemq:activemq-broker's releases.

Apache ActiveMQ 6.2.5

What's Changed

• Bump to 6.2.5-SNAPSHOT version by @​jbonofre in apache/activemq#1892
• [6.2.x] SSL handshake write timeout enforcement (#1883) by @​cshannon in apache/activemq#1894
• [6.2.x] Minor bug fix for BrokerView#validateAllowedUri (#1900) by @​cshannon in apache/activemq#1902
• [6.2.x] Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) by @​cshannon in apache/activemq#1915
• compilation-fix by @​cshannon in apache/activemq#1919
• [6.2.x] Make brokerName immutable in RegionBroker (#1917) by @​cshannon in apache/activemq#1923
• [6.2.x] Add Http discovery transport to denied list for JMX (#1918) by @​cshannon in apache/activemq#1925
• [6.2.x] Update resource cleanup on queueBrowse servlet (#1912) by @​cshannon in apache/activemq#1928
• [6.2.x] Update DestinationView uri resolution (#1914) by @​cshannon in apache/activemq#1930
• fix(webconsole): the webconsole now redirect to the slave.jsp when required (slave broker with startAsync="true") [6.2.x] by @​jbonofre in apache/activemq#1934
• [6.2.x] Queue browse improvements in webconsole (#1938) by @​cshannon in apache/activemq#1942
• [6.2.x] Add more transport types to the denied list for JMX (#1949) by @​cshannon in apache/activemq#1952
• [6.2.x] Add remote file filtering for XBeanBrokerFactory (#1950) by @​cshannon in apache/activemq#1954

Full Changelog: apache/activemq@activemq-6.2.4...activemq-6.2.5

Commits

• cfa7998 [maven-release-plugin] prepare release activemq-6.2.5
• 881ce9d Add remote file filtering for XBeanBrokerFactory (#1950) (#1954)
• e19cc3e Add more transport types to the denied list for JMX (#1949) (#1952)
• 0982ba4 Queue browse improvements in webconsole (#1938) (#1942)
• 1dabafb fix(webconsole): the webconsole now redirect to the slave.jsp when required (...
• 2b8455b #1913 Update DestinationView uri resolution (#1914)
• 1b7b1e0 #1911 Update resource cleanup on queueBrowse servlet (#1912)
• 3b3dc08 Add Http discovery transport to denied list for JMX (#1918) (#1925)
• 8c929d0 Make brokerName immutable in RegionBroker (#1917) (#1923)
• eccbe4c compilation-fix (#1919)
• Additional commits viewable in compare view

Updates org.apache.activemq:activemq-broker from 6.2.4 to 6.2.5

Release notes

Sourced from org.apache.activemq:activemq-broker's releases.

Apache ActiveMQ 6.2.5

What's Changed

• Bump to 6.2.5-SNAPSHOT version by @​jbonofre in apache/activemq#1892
• [6.2.x] SSL handshake write timeout enforcement (#1883) by @​cshannon in apache/activemq#1894
• [6.2.x] Minor bug fix for BrokerView#validateAllowedUri (#1900) by @​cshannon in apache/activemq#1902
• [6.2.x] Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) by @​cshannon in apache/activemq#1915
• compilation-fix by @​cshannon in apache/activemq#1919
• [6.2.x] Make brokerName immutable in RegionBroker (#1917) by @​cshannon in apache/activemq#1923
• [6.2.x] Add Http discovery transport to denied list for JMX (#1918) by @​cshannon in apache/activemq#1925
• [6.2.x] Update resource cleanup on queueBrowse servlet (#1912) by @​cshannon in apache/activemq#1928
• [6.2.x] Update DestinationView uri resolution (#1914) by @​cshannon in apache/activemq#1930
• fix(webconsole): the webconsole now redirect to the slave.jsp when required (slave broker with startAsync="true") [6.2.x] by @​jbonofre in apache/activemq#1934
• [6.2.x] Queue browse improvements in webconsole (#1938) by @​cshannon in apache/activemq#1942
• [6.2.x] Add more transport types to the denied list for JMX (#1949) by @​cshannon in apache/activemq#1952
• [6.2.x] Add remote file filtering for XBeanBrokerFactory (#1950) by @​cshannon in apache/activemq#1954

Full Changelog: apache/activemq@activemq-6.2.4...activemq-6.2.5

Commits

• cfa7998 [maven-release-plugin] prepare release activemq-6.2.5
• 881ce9d Add remote file filtering for XBeanBrokerFactory (#1950) (#1954)
• e19cc3e Add more transport types to the denied list for JMX (#1949) (#1952)
• 0982ba4 Queue browse improvements in webconsole (#1938) (#1942)
• 1dabafb fix(webconsole): the webconsole now redirect to the slave.jsp when required (...
• 2b8455b #1913 Update DestinationView uri resolution (#1914)
• 1b7b1e0 #1911 Update resource cleanup on queueBrowse servlet (#1912)
• 3b3dc08 Add Http discovery transport to denied list for JMX (#1918) (#1925)
• 8c929d0 Make brokerName immutable in RegionBroker (#1917) (#1923)
• eccbe4c compilation-fix (#1919)
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• Description has been truncated