Bump the maven group across 6 directories with 3 updates

[dependabot]

Bumps the maven group with 1 update in the /stream-legal-entity/legal-entity-bootstrap-task directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-legal-entity/legal-entity-http directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-portfolio/portfolio-http directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-product-catalog/product-catalog-task directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 2 updates in the /stream-sdk/stream-parent directory: org.wiremock:wiremock-standalone and org.bouncycastle:bcpkix-jdk18on.
Bumps the maven group with 2 updates in the /stream-sdk/stream-parent/stream-test-support directory: org.wiremock:wiremock-standalone and org.bouncycastle:bcpkix-jdk18on.

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
• 3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
• 0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
• 18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
• Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

• WireMock Docker 3.0.3-1 - Docker Image with the Patch
• WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x
• Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file
• NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

3.0.2

🐛 Bug fixes

• fix: avoid crash when printing help in wiremock-standalone (#2351) @​tomasbjerre

👻 Maintenance

• Reset system properties at end of test (#2356) @​Mahoney

📦 Dependency updates

• Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @​dependabot
• Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @​dependabot
• Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @​dependabot

Commits

• 7a51264 Bumped patch version
• 0f72091 Stop NetworkAddressRules doing DNS lookups
• 984e79f Make NetworkAddressRulesAdheringDnsResolver testable
• 92d7793 Applied DNS resolver enforcement to webhooks extension
• 027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
• 21a9622 Bumped patch version
• 1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)