elmozgo / portalmirror Goto Github PK

    "socketio-jwt": "^4.5.0",
    "socketio-jwt-auth": "0.0.5",

which one of them is used by the app?

replace actual keys with OVERRIDE_ME

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.8.11.1 or later. For example:

Always verify the validity and compatibility of suggestions with your codebase.
Details
CVE-2018-7489 More information
high severity
Vulnerable versions: < 2.8.11.1
Patched version: 2.8.11.1

FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
CVE-2017-7525 More information
high severity
Vulnerable versions: < 2.6.7.1
Patched version: 2.6.7.1

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Twitter API doesn't work in the way that I thought it does in terms of getting all replies to a status. With the current implementation and recursive way to build the replies tree it is super quick to reach API calls limits.

I introduced caching in TwitterRepository of getRepliesToUser and it works but the code is very very bad way.

Instead of getting replies for each status, TwitterFeedFactory should retrieve all replies to the user, then top 20 statuses of the user and then having both sets build the feed tree.

move the hardcoded api key to Portlet Settings