Design/Logic Flaw

2019-06-0314:29:00

PRIOn knowledge base

www.prio-n.com

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.1%

JSON

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

CPENameOperatorVersion
spring_data_java_persistance_apige1.11.0
spring_data_java_persistance_apile1.11.21
spring_data_java_persistance_apige2.0.0
spring_data_java_persistance_apile2.0.14
spring_data_java_persistance_apige2.1.0
spring_data_java_persistance_apile2.1.7

Name	Operator	Version
spring_data_java_persistance_api	ge	1.11.0
spring_data_java_persistance_api	le	1.11.21
spring_data_java_persistance_api	ge	2.0.0
spring_data_java_persistance_api	le	2.0.14
spring_data_java_persistance_api	ge	2.1.0
spring_data_java_persistance_api	le	2.1.7

References

pivotal.io/security/cve-2019-3802