{"action":"Upgrade com.fasterxml.util:java-merge-sort to 1.1.0 or later.","affected":[{"fixed":"1.1.0","introduced":"0"}],"component":"com.fasterxml.util:java-merge-sort","cve_ids":["CVE-2022-24913"],"ecosystem":"Maven","epss":0.00251,"exploited":false,"fixed_versions":["1.1.0"],"ghsa_id":"GHSA-qxxc-7mq4-mf79","id":"tcs_01M5N9AKXP3P5DRXXHX2N9WKAS","modified_at":"2023-11-08T04:08:40.218167Z","published_at":"2023-01-12T06:30:24Z","references":["https://osv.dev/vulnerability/GHSA-qxxc-7mq4-mf79","https://nvd.nist.gov/vuln/detail/CVE-2022-24913","https://github.com/cowtowncoder/java-merge-sort/pull/21","https://github.com/cowtowncoder/java-merge-sort/commit/450fdee70b5f181c2afc5d817f293efa1a543902","https://github.com/cowtowncoder/java-merge-sort","https://security.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLUTIL-3227926"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-qxxc-7mq4-mf79","url":"https://osv.dev/vulnerability/GHSA-qxxc-7mq4-mf79"}],"summary":"Java Merge-sort Insecure Temporary File vulnerability"}