Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator

Summary IBM Sterling B2B Integrator has addressed multiple Spring Framework security vulnerabilites. Vulnerability Details CVEID:CVE-2013-4152 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error...

com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (2.0)

org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=0.4, <=0.5), ch.ralscha:extdirectspring (1.4.0) +75 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (>=4.0.0.release, <=4.0.1.release)

org.springframework:spring-webmvc MAVEN version =4.0.0.release, =0.4, =0.1.1-alpha, =0.2-alpha, =1.0.0, =2.0.3.2.1, =2.1.3.10.1, =2.0.3.6, =2.0.3.6, =2.1.2.7.1, =2.0.3.1, =2.1.4.19 and more Source cves: CVE-2014-0054 Source advisory: OSV:GHSA-8CMM-QJ8G-FCP6...

org.acegisecurity:acegi-security-samples-contacts (1.0.7), org.andromda.andromdapp.projects:andromda-andromdapp-project-richclient-ant (3.3) +1 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (1.2.9)

org.springframework:spring-webmvc MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.acegisecurity:acegi-security-samples-contacts 1.0.7 -...

org.apache.portals.bridges:springmvc (1.0.4), org.apache.portals.jetspeed-2:j2-admin (>=2.1.3, <=2.1.4) +13 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (2.0.5)

org.springframework:spring-webmvc MAVEN version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.portals.bridges:springmvc 1.0.4 - org.apache.portals.jetspeed-2:j2-admin =2.1.3,...

org.springframework:spring-hibernate (1.2.1), org.springframework:spring-orm (1.2.1) +1 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (1.2.1)

org.springframework:spring-webmvc MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework:spring-hibernate 1.2.1 - org.springframework:spring-orm 1.2.1 -...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=0.4, <=0.5), ch.ralscha:extdirectspring (1.4.0) +75 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (>=4.0.0.release, <=4.0.1.release)

org.springframework:spring-webmvc MAVEN version =4.0.0.release, =0.4, =0.1.1-alpha, =0.2-alpha, =1.0.0, =2.0.3.2.1, =2.1.3.10.1, =2.0.3.6, =2.0.3.6, =2.1.2.7.1, =2.0.3.1, =2.1.4.19 and more Source cves: CVE-2014-0054 Source advisory: GHSA-8CMM-QJ8G-FCP6...

org.springmodules:spring-modules-jakarta-commons (>=0.8, <=0.8a), org.springmodules:spring-modules-osworkflow (>=0.8, <=0.8a) potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (2.0.3)

org.springframework:spring-webmvc MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons =0.8, =0.8, =0.8a Source cves: CVE-2014-0054...

net.sourceforge.openutils:openutils-spring (0.2) potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (2.0-m5)

org.springframework:spring-webmvc MAVEN version 2.0-m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sourceforge.openutils:openutils-spring 0.2 Source cves: CVE-2014-0054 Source advisory:...

com.payneteasy.superfly:superfly-web (>=1.1-1, <=1.1-2), org.grails:grails-webflow (>=2.2.0.rc2, <=2.2.4) +9 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (2.5.6.sec01)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.payneteasy.superfly:superfly-web =1.1-1, =2.2.0.rc2, =2.0.2, =1.0.0.release,...

net.sf.json-lib:json-lib-ext-spring (1.0), org.apache.activemq:activemq-web (5.1.0) +9 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (2.5.1)

org.springframework:spring-webmvc MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sf.json-lib:json-lib-ext-spring 1.0 - org.apache.activemq:activemq-web 5.1.0 -...

com.cedarsoft.commons:rmi (>=1.6.1, <=1.6.3), org.appfuse:appfuse-spring (2.0.1) +7 more potentially affected by CVE-2014-0054 via org.springframework:spring-webmvc (2.5)

org.springframework:spring-webmvc MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.cedarsoft.commons:rmi =1.6.1, =2.0.3, =2.0.3, =2.0.4 -...

Mageia: Security Advisory (MGASA-2014-0155)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Pivotal Spring Framework vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM)

Summary Multiple vulnerabilities have been identified in the OpenSource/Pivotal Spring Framework version that is embeddded in IBM Tivoli Application Dependency Discovery Manager TADDM thus requiring an upgrade to Spring Framework version 3.2.13. Vulnerability Details CVEID: CVE-2014-3578...

Security Bulletin: Pivotal Spring Framework as used in IBM QRadar SIEM is vulnerable to various CVE's

Summary OpenSource Pivotal Spring Framework as used in IBM QRadar is susceptible to several vulnerabilities. Vulnerability Details CVEID: CVE-2013-7315 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection X...

Security Bulletin: OpenSource Spring Source/Pivotal Spring Framework Vulnerabilities affect IBM Security Guardium (CVE-2013-7315, CVE-2013-4152, CVE-2014-0054)

Summary Pivotal Spring Framework could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2013-7315 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when...

CVE-2014-0054

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML Extern...

CVE-2014-0054

CVE-2014-0054 is a XXE in Spring Framework’s Jaxb2RootElementHttpMessageConverter used by Spring MVC. Affected: Spring Framework before 3.2.8 and before 4.0.2 (specifically 4.0.0–4.0.2). Root cause: external entity resolution not disabled, allowing remote attackers to read arbitrary files, cause ...

Debian DSA-2890-1 : libspring-java - security update

Two vulnerabilities were discovered in libspring-java, the Debian package for the Java Spring framework. - CVE-2014-0054 Jaxb2RootElementHttpMessageConverter in Spring MVC processes external XML entities. - CVE-2014-1904 Spring MVC introduces a cross-site scripting vulnerability if the action on ...

[SECURITY] [DSA 2890-1] libspring-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2890-1 [email protected] http://www.debian.org/security/ Florian Weimer March 29, 2014 http://www.debian.org/security/faq -...