org.apache.ivy:ivy
Maven3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.apache.ivy:ivypage 1 of 1
- CVE-2022-37865CRITICALCVSS 9.1EG 9.1✓ Fixed in 2.5.12022-11-07
vulnerable: 2.4.0, 2.5.0, 2.5.0-rc1
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doe…
- CVE-2022-37866HIGHCVSS 7.5EG 7.5✓ Fixed in 2.5.12022-11-07
vulnerable: 2.0.0 ... 2.5.0-rc1 (13 versions)
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coor…
- CVE-2022-46751HIGHCVSS 8.2EG 8.2✓ Fixed in 2.5.22023-08-21
vulnerable: 2.0.0 ... 2.5.1 (18 versions)
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to …
Check whether org.apache.ivy:ivy is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.apache.ivy:ivy CVEs against the assets you own.
Start Free Scan →