Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator

Summary IBM Sterling B2B Integrator has addressed multiple Spring Framework security vulnerabilites. Vulnerability Details CVEID:CVE-2013-4152 DESCRIPTION: Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error...

Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Spring Security

Summary Spring Security is used by IBM Sterling B2B Integrator. Multiple Spring Security vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2019-3795 DESCRIPTION: Pivotal Spring Security could provide weaker than expected security, caused by an insecure randomness flaw when usin...

[SECURITY] [DLA 1848-1] libspring-security-2.0-java security update

Package : libspring-security-2.0-java Version : 2.0.7.RELEASE-3+deb8u2 CVE ID : CVE-2019-11272 Spring Security support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null...

org.eobjects.datacleaner:datacleaner-completeness-analysis-wizard (>=3.5.9, <=3.7.4), org.eobjects.datacleaner:datacleaner-copy-data-wizard (>=3.5.9, <=3.7.4) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.1.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: -...

org.jasig.cas:cas-server-webapp (>=3.5.0-rc1, <=3.6.0) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.0.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.jasig.cas:cas-server-webapp =3.5.0-rc1, =3.6.0 Sour...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.github.yongjacky:jee.borneo.miri (1.1.6) +111 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.4.release)

org.springframework.security:spring-security-core MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - be.dnsbelgium:rdap-server =0.3.3, =1.6-2, =1.6.0,...

com.sitewhere:sitewhere-activemq (>=1.0.2, <=1.4.0), com.sitewhere:sitewhere-azure (>=1.0.2, <=1.4.0) +68 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.6.release)

org.springframework.security:spring-security-core MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.sitewhere:sitewhere-activemq =1.0.2, =1.0.2,...

co.paralleluniverse:comsat-spring-security (0.3.0), com.bq.corbel:oauth-server (>=1.31.1, <=1.35.0) +289 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.5.release)

org.springframework.security:spring-security-core MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - co.paralleluniverse:comsat-spring-security 0.3.0 -...

com.allanditzel:spring-security-csrf-token-filter (1.1), com.btmatthews.atlas:atlas-jcr (1.0.1) +140 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.2.0.release)

org.springframework.security:spring-security-core MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.allanditzel:spring-security-csrf-token-filter 1.1...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.11), ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7) +2345 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (>=4.0.0.release, <=4.2.12.release)

org.springframework.security:spring-security-core MAVEN version =4.0.0.release, =0.1.8, =0.1.6, =0.1.4-sb1x, =1.0.0, =1.0.0, =1.0.0, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 and more Source cves: CVE-2019-11272 Source advisory:...

org.opencastproject:opencast-security-cas (>=7.2, <=18.5) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.7.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.opencastproject:opencast-security-cas =7.2, =18.5...

org.springframework.security:spring-security-acl (2.0.2), org.springframework.security:spring-security-adapters (2.0.2) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.2)

org.springframework.security:spring-security-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl 2.0.2 -...

com.github.jackpanz:maccloud-core (>=2.4.7, <=2.4.8), com.gwtincubator:gwt-incubator-security (1.0.1) +74 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (2.0.4)

org.springframework.security:spring-security-core MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.jackpanz:maccloud-core =2.4.7, =1.1-1, =1.1-2 -...

com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta), com.logitags:cibet (>=1.1, <=1.9) +24 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.0.3.release)

org.springframework.security:spring-security-core MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.force.sdk:force-springsecurity =22.0.2-beta, =1.1...

com.racquettrack:spring-security-oauth2-client (1.4), com.sitewhere:sitewhere-core (0.9.7) +40 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.1.release)

org.springframework.security:spring-security-core MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.racquettrack:spring-security-oauth2-client 1.4 -...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.leleuj.springframework.security:spring-security-oauth-client (>=1.0.0, <=1.1.0) +137 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.1.0.release)

org.springframework.security:spring-security-core MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.ctlok:spring-webmvc-rythm =1.3.6, =1.0.0, =3.0.4,...

cn.dceast.platform:platform-security-starter (2.2.3), com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.0.114-release) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (>=4.0.1.release, <=4.2.8.release)

org.springframework.security:spring-security-cas MAVEN version =4.0.1.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.0.83-rc1, =1.0.83-rc1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =9.4.0.10, =0.3.1, =0.3.1, =0.3.2 - net.eulerframework:euler-web-authentication-impl-hibernate 0.3.9 and more Source cves...

com.vnomicscorp:spring-stateless-ticket-cache-redis (1.0.3), org.eobjects.datacleaner:datacleaner-monitor-completeness-analysis-wizard (>=4.0-rc5, <=4.0.9) +10 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.5.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - com.vnomicscorp:spring-stateless-ticket-cache-redis 1.0...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.4, <=3.0.1), br.net.woodstock.rockframework:rockframework-persistence (>=2.0.0, <=2.0.8) +23 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-core (3.0.6.release)

org.springframework.security:spring-security-core MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - br.net.woodstock.rockframework:rockframework-domain...

cn.dceast.platform:platform-security-starter (2.2.3), com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.0.114-release) +18 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (>=4.0.1.release, <=4.2.8.release)

org.springframework.security:spring-security-cas MAVEN version =4.0.1.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.0.83-rc1, =1.0.83-rc1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =9.4.0.10, =0.3.1, =0.3.1, =0.3.2 - net.eulerframework:euler-web-authentication-impl-hibernate 0.3.9 and more Source cves...