[GHSA-h755-h99p-9ffv] An issue was discovered in weixin-java-tools v3.3.0....

[q5438722]

Updates

• Affected products
• Summary

Comments
In the given reference:
binarywang/WxJava#903

It provides the vulnerability patch link in the version 3.3.2.B:
binarywang/WxJava@8ec61d1

This link indicates that the affected package is com.github.binarywang:weixin-java-common.

[darakian]

Based on the tags in
binarywang/WxJava@8ec61d1
The fixed version looks to me like it might be 3.4.0.
Though the date does line up with 3.3.2.B
https://central.sonatype.com/artifact/com.github.binarywang/weixin-java-common/3.3.2.B/versions
What do you think?

[q5438722]

You are right. I also notice that this patch version is a test version.

[darakian]

I also notice that this patch version is a test version.

A test version that got published?

[q5438722]

This version is just mentioned by one member of this repository.

Thus, the fixed version shall be 3.4.0 (as a published one).

[darakian]

Gotcha. Many thanks. For the sake of the thread that comment is here
binarywang/WxJava#903 (comment)

[advisory-database]

Hi @q5438722! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!