{"id":"GHSA-fjh6-p566-wr6q","aliases":[],"status":"published","title":"skylot jadx affected by Incorrect Behavior Order in vulnerable dependency","description":"### Impact\nVulnerable library protobuf-java 3.11.4 (CVE-2021-22569)\n\n### Patches\nDependency updated in jadx 1.4.3\n\n### References\nAccording to the AquaSecurity report:\n![05F1C52A666E4FCC844ABD085BD55124](https://user-images.githubusercontent.com/118523/177364939-087e2144-9a8a-4594-ae90-eb2acb0a2036.png)\n\nAlso, Maven repository have links to this and other vulnerabilities from dependencies:\nhttps://mvnrepository.com/artifact/com.google.protobuf/protobuf-java/3.11.4","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-696"],"published":"2022-07-21T22:35:12Z","modified":"2024-11-28T05:41:28Z","fixes":[{"ecosystem":"Maven","package":"io.github.skylot:jadx-core","fixed_in":["1.4.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.github.skylot:jadx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.2"},{"fixed":"1.4.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.github.skylot:jadx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}],"versions":["1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.2"]}],"references":[{"url":"https://github.com/skylot/jadx/security/advisories/GHSA-fjh6-p566-wr6q","tags":["web"]},{"url":"https://github.com/skylot/jadx/releases/tag/v1.4.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fjh6-p566-wr6q"},{"url":"https://github.com/skylot/jadx","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-fjh6-p566-wr6q","title":"skylot jadx affected by Incorrect Behavior Order in vulnerable dependency","description":"### Impact\nVulnerable library protobuf-java 3.11.4 (CVE-2021-22569)\n\n### Patches\nDependency updated in jadx 1.4.3\n\n### References\nAccording to the AquaSecurity report:\n![05F1C52A666E4FCC844ABD085BD55124](https://user-images.githubusercontent.com/118523/177364939-087e2144-9a8a-4594-ae90-eb2acb0a2036.png)\n\nAlso, Maven repository have links to this and other vulnerabilities from dependencies:\nhttps://mvnrepository.com/artifact/com.google.protobuf/protobuf-java/3.11.4","status":"published","published":"2022-07-21T22:35:12Z","modified":"2023-01-12T05:02:56Z","cwes":["CWE-696"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-fjh6-p566-wr6q","title":"skylot jadx affected by Incorrect Behavior Order in vulnerable dependency","description":"### Impact\nVulnerable library protobuf-java 3.11.4 (CVE-2021-22569)\n\n### Patches\nDependency updated in jadx 1.4.3\n\n### References\nAccording to the AquaSecurity report:\n![05F1C52A666E4FCC844ABD085BD55124](https://user-images.githubusercontent.com/118523/177364939-087e2144-9a8a-4594-ae90-eb2acb0a2036.png)\n\nAlso, Maven repository have links to this and other vulnerabilities from dependencies:\nhttps://mvnrepository.com/artifact/com.google.protobuf/protobuf-java/3.11.4","status":"published","published":"2022-07-21T22:35:12Z","modified":"2024-11-28T05:41:28.89555Z","cwes":["CWE-696"],"updated_at":"2026-11-02T15:46:46.39441Z"}]}}