Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 11, 2023

This PR contains the following updates:

Package Change Age Confidence
org.testcontainers:junit-jupiter (source) 1.19.1 -> 1.21.3 age confidence
org.testcontainers:postgresql (source) 1.19.1 -> 1.21.3 age confidence
io.jsonwebtoken:jjwt 0.9.1 -> 0.13.0 age confidence
org.springframework.cloud:spring-cloud-contract-wiremock 3.1.1 -> 3.1.10 age confidence
com.github.tomakehurst:wiremock-jre8-standalone (source) 2.32.0 -> 2.35.1 age confidence

GitHub Vulnerability Alerts

CVE-2023-41329

Impact

The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to the DNS rebinding attacks. A similar patch was applied in WireMock 3.0.0-beta-15 for the WireMock Webhook Extensions.

The root cause of the attack is a defect in the logic which allows for a race condition triggered by a DNS server whose address expires in between the initial validation and the outbound network request that might go to a domain that was supposed to be prohibited. Control over a DNS service is required to exploit this attack, so it has high execution complexity and limited impact.

Affected versions

  • WireMock 3,x until 3.0.3 (security patch), on default settings in environments with access to the network
  • WireMock 2.x until 2.35.1 (security patch), on default settings in environments with access to the network
  • Python WireMock until 2.6.1
  • WireMock Studio - all versions, this proprietary product was discontinued in 2022

Patches

  • WireMock 3.0.3 + the 3.0.3-1 Docker image
  • WireMock 2.35.1 + the 2.35.1-1 Docker image - backport to WireMock 2.x
  • Python WireMock 2.6.1

Workarounds

For WireMock:

  • Option 1: Configure WireMock to use IP addresses instead of the domain names in the outbound URLs subject to DNS rebinding
  • Option 2: Use external firewall rules to define the list of permitted destinations

For WireMock Studio: N/A. Switch to another distribution, there will be no fix provided. The vendor of former WireMock Studio recommends migration to WireMock Cloud

References


Release Notes

testcontainers/testcontainers-java (org.testcontainers:junit-jupiter)

v1.21.3

Compare Source

What's Changed

v1.21.2

Compare Source

What's Changed
📖 Documentation
📦 Dependency updates

v1.21.1

Compare Source

What's Changed

🚀 Features & Enhancements

🐛 Bug Fixes

  • Use generic init script filename when copying it into a Cassandra container (#​9606) @​maximevw

📖 Documentation

📦 Dependency updates

v1.21.0

Compare Source

What's Changed
⚠️ Breaking API changes
🚀 Features & Enhancements
☠️ Deprecations
🐛 Bug Fixes
📖 Documentation
🧹 Housekeeping
📦 Dependency updates

v1.20.6

Compare Source

What's Changed

  • Bump confluentinc/cp-kcat from 7.4.1 to 7.9.0 (#​10000) @​julianladisch
  • Set sourceCompatibility and targetCompatibility to 1.8 in spock module

v1.20.5

Compare Source

What's Changed

🚀 Features & Enhancements

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

📦 Dependency updates

v1.20.4

Compare Source

What's Changed
🚀 Features & Enhancements
🐛 Bug Fixes
📖 Documentation
📦 Dependency updates

v1.20.3

Compare Source

What's Changed
🚀 Features & Enhancements
🐛 Bug Fixes
📖 Documentation
🧹 Housekeeping

v1.20.2

Compare Source

What's Changed

🚀 Features & Enhancements

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

📦 Dependency updates

v1.20.1

Compare Source

What's Changed
🚀 Features & Enhancements
🐛 Bug Fixes
📖 Documentation
🧹 Housekeeping
📦 Dependency updates
8 changes

v1.20.0

Compare Source

What's Changed
🚀 Features & Enhancements
🐛 Bug Fixes
📖 Documentation
🧹 Housekeeping
📦 Dependency updates

v1.19.8

Compare Source

Testcontainers for Java 1.19.8

🚀 Features & Enhancements

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

📦 Dependency updates

v1.19.7

Compare Source

Testcontainers for Java 1.19.7

Modules

Elasticserach

HiveMQ
MongoDB
PostgreSQL

📖 Documentation

📦 Dependency updates

v1.19.6

Compare Source

Testcontainers for Java 1.19.6
Modules
New modules
📖 Documentation
🧹 Housekeeping
📦 Dependency updates

v1.19.5

Compare Source

Testcontainers for Java 1.19.5

[!IMPORTANT]
This version has downgraded the commons-compress version to 1.24.0 in order to avoid classpath conflicts due to a recent change in commons-compress 1.25.0. See #​8169 for more details.

v1.19.4

Compare Source

Testcontainers for Java 1.19.4
Core
Modules


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner October 11, 2023 15:34
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch 2 times, most recently from 0fffd42 to 9d308b2 Compare October 15, 2023 07:10
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch 2 times, most recently from ccf3c7e to 75addc7 Compare October 27, 2023 07:08
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch 2 times, most recently from 2169253 to 6605d8b Compare November 21, 2023 16:51
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 6605d8b to 5c1b9d1 Compare December 19, 2023 07:37
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch 3 times, most recently from d3b82a6 to 67a5d94 Compare January 29, 2024 03:15
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 67a5d94 to e13b26e Compare February 1, 2024 03:31
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch 2 times, most recently from deba1e7 to 1fb0250 Compare February 8, 2024 16:37
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 1fb0250 to 860604d Compare February 22, 2024 10:01
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 860604d to 7b9f365 Compare March 5, 2024 19:29
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 7b9f365 to a442bb3 Compare May 1, 2024 10:32
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from a442bb3 to 630d67b Compare May 8, 2024 22:53
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 630d67b to ad2ef64 Compare June 21, 2024 22:35
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from ad2ef64 to 41bff0b Compare July 17, 2024 17:01
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 41bff0b to e9de70f Compare July 31, 2024 16:42
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from e9de70f to 0b8fa54 Compare October 1, 2024 00:06
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 0b8fa54 to 1fd54c5 Compare October 23, 2024 00:05
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 1fd54c5 to 2560a44 Compare November 20, 2024 23:05
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 2560a44 to 11e8235 Compare January 23, 2025 18:17
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch 2 times, most recently from b1490ff to 360d68c Compare February 20, 2025 23:04
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 360d68c to e0fc794 Compare March 4, 2025 22:56
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from e0fc794 to 7f1d3d1 Compare April 24, 2025 03:51
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 7f1d3d1 to 084327e Compare May 30, 2025 01:48
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 084327e to 2db94da Compare June 19, 2025 04:03
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from 2db94da to c275e31 Compare June 29, 2025 01:56
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from c275e31 to a4beb43 Compare August 14, 2025 20:43
@renovate renovate bot force-pushed the renovate/all-maven-test-deps branch from a4beb43 to d1539f5 Compare August 21, 2025 03:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants