CVE-2024-23081
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A potential NullPointerException was discovered in ThreeTen Backport version 1.6.8 in the compareTo method of the LocalDate class. However, multiple third parties dispute the validity of this vulnerability, suggesting the report may be based on an insufficiently robust tool.
Risk Assessment
The risk to the organization is low as the vulnerability is disputed and may not be a real threat. If confirmed, the exception could lead to unexpected application termination.
Recommendation
It is recommended to monitor official updates for the ThreeTen Backport library and verify the vulnerability reports. In the meantime, consider implementing temporary safeguards such as input validation before using the compareTo method.
Original NVD description (English source)
ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.