Maven/com.diffplug.gradle:goomph CVE-2022-26049: high 8.8, EPSS 2.48%
Goomph before 3.37.2 allows malicious zip file to write contents to arbitrary locations
Action: Upgrade com.diffplug.gradle:goomph to 3.37.2 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.37.2 | - |
Fixed versions
| 3.37.2 |
Sources
- osv: GHSA-p2f7-9cv7-jjf6
- https://nvd.nist.gov/vuln/detail/CVE-2022-26049
- https://github.com/diffplug/goomph/pull/198
- https://github.com/diffplug/goomph/commit/25f04f67ba62d9a14104bee13a0a0f2517afb8c8
- https://security.snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGGRADLE-2981040
CVE-2022-26049 · published · modified · JSON