Linux Distros Unpatched Vulnerability : CVE-2023-20883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service...

Security Bulletin: IBM Sterling Control Center vulnerable to denial of service due to Spring Boot and remote code execution due to Spring Framework

Summary IBM Sterling Control Center containerized image uses VMWare Tanzu Spring Boot and Pivotal Spring Framework. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-20883 DESCRIPTION: VMware Tanzu Spring Boot is vulnerable to a denial...

Vulnerabilities fixed in Oracle Financial Services Applications

Vulnerabilities have been fixed in Oracle Financial Services Applications products. A malicious party could exploit them to launch attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data Bypassing authentication Accessing sensitive data Oracle has...

Security Bulletin: IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities

Summary IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2022-25647 DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

Security Bulletin: VMware Tanzu Spring Boot is vulnerable to CVE-2023-20883 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses VMware Tanzu Spring Boot which is vulnerable to CVE-2023-20883. Vulnerability Details CVEID:CVE-2023-20883 DESCRIPTION: VMware Tanzu Spring Boot is vulnerable to a denial of service, caused by a flaw when Spring MVC is used together wi...

Important: Red Hat Security Advisory: Red Hat Build of OptaPlanner 8.38.0 for Quarkus 2.13.8 security update

Red Hat Build of OptaPlanner 8.38.0 for Quarkus 2.13.8 release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scori...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in VMware Tanzu Spring Boot

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of VMware Tanzu Spring Boot. Vulnerability Details CVEID:CVE-2023-20873 DESCRIPTION: VMware Tanzu Spring Boot could allow a remote attacker to bypass security restrictions, caused by a flaw with wildca...

Important: Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.20.1 Patch 1 release security update

Red Hat Integration Camel for Spring Boot 3.20.1 Patch 1 release and security update is now available. Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release

Camel for Spring Boot 3.18.3 Patch 2 release and security update is now available. Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

ch.sahits.game:openpatricianclientserverinterface (>=0.9.0-rc1, <=0.9.0), ch.sahits.game:openpatriciandisplay (>=0.9.0-rc1, <=0.9.0) +763 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.5.3.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - ch.sahits.game:openpatricianclientserverinterface...

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), cn.home1:oss-configlint (1.0.6.oss) +1187 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.4.1.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.6.oss,...

cn.jiangzeyin.fast-boot:common-boot (>=1.1.12, <=1.2.39), cn.jiangzeyin.fast-boot:common-redis (>=1.0.3, <=1.2.39) +229 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.4.7.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - cn.jiangzeyin.fast-boot:common-boot =1.1.12, =1.0.3...

cn.patterncat:event-trace-client (>=1.0.0, <=1.3.0), cn.patterncat:job-common (>=0.0.2, <=0.0.3) +101 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.4.6.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - cn.patterncat:event-trace-client =1.0.0, =0.0.2,...

org.springframework.boot:spring-boot-actuator (1.1.2.release), org.springframework.boot:spring-boot-docs (1.1.2.release) +27 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.2.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.springframework.boot:spring-boot-actuator...

au.com.mountain-pass:hyperstate (>=4, <=9), ch.sbb.releasetrain:action (>=0.0.21, <=0.0.23) +500 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.3.5.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - au.com.mountain-pass:hyperstate =4, =0.0.21, =0.0.2...

com.github.cafdataprocessing:boilerplate-api-web (>=2.0.0-5, <=2.3.0-92), com.github.cafdataprocessing:corepolicy-web (>=1.0.0-4, <=1.2.0-165) +35 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.3.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.cafdataprocessing:boilerplate-api-web...

au.com.mountain-pass:hyperstate (>=1, <=3), cc.catalysts.boot:cat-boot-cluster (>=0.0.10, <=0.1.14) +153 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.3.2.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.0.10, =0.0.5...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.djl.spring:djl-spring-boot-starter-autoconfigure (0.15) +7491 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.6.0, <=2.6.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.1 - ai.ylyue:yue-library-data-mybatis j11.2.6.2 and more Source cves: CVE-2023-20883 Source advisory: OSV:GHSA-XF96-W227-R7C4...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure (1.0.2), cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2) +244 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.5.21.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: -...