Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in spring-boot-2.7.12.jar

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of spring-boot-2.7.12.jar Vulnerability Details CVEID:CVE-2023-34055 DESCRIPTION: In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that...

Important: Red Hat Security Advisory: Red Hat Fuse 7.13.0 release and security update

Red Hat Fuse 7.13.0 release is now available. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to VMware Tanzu Spring Boot arbitrary denial of service vulnerability ( CVE-2023-34055)

Summary Potential VMware Tanzu Spring Boot arbitrary denial of service vulnerability CVE-2023-34055 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details...

VMware Spring Boot 2.7.0 - 2.7.17, 3.0.0 - 3.0.12, 3.1.0 - 3.1.5 DoS Vulnerability

VMware Spring Boot is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +68 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.3.0.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-start...

com.hotels:waggle-dance-api (>=2.0.0, <=2.1.0), com.netflix.genie:genie-app (>=3.0.0-rc.26, <=3.0.11) +14 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.3.8.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.hotels:waggle-dance-api =2.0.0, =3.0.0-rc.26, =3.0.0-rc.2...

org.springframework.boot:spring-boot-docs (1.1.12.release), org.springframework.boot:spring-boot-starter-actuator (1.1.12.release) +1 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.12.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - org.springframework.boot:spring-boot-docs 1.1.12.release -...

cn.dubby:itbus (>=0.2.7, <=0.2.8), com.cedarsoftware:n-cube (>=4.0.6, <=4.0.16) +278 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.3.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - cn.dubby:itbus =0.2.7, =4.0.6, =2.0.2-release, =1.0.7, =1.0.7...

org.springframework.boot:spring-boot-docs (1.1.0.release), org.springframework.boot:spring-boot-starter-actuator (1.1.0.release) +1 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.0.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - org.springframework.boot:spring-boot-docs 1.1.0.release -...

com.github.zed-platform:zed-service-attachment-file (0.0.20), com.github.zed-platform:zed-service-document-elasticsearch (0.0.20) +30 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.2.2.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.zed-platform:zed-service-attachment-file 0.0.20 -...

org.springframework.boot:spring-boot-docs (1.0.0.release), org.springframework.boot:spring-boot-starter-actuator (1.0.0.release) +1 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.0.0.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - org.springframework.boot:spring-boot-docs 1.0.0.release -...

com.github.totyumengr:minicubes-cluster (0.2), de.codecentric:spring-boot-starter-batch-web (1.1.0.release) +6 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.4.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.totyumengr:minicubes-cluster 0.2 -...

de.codecentric:spring-boot-admin-example (1.0.2), de.codecentric:spring-boot-admin-server (1.0.2) +10 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.1.6.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - de.codecentric:spring-boot-admin-example 1.0.2 -...

de.codecentric:spring-boot-admin-sample (>=1.2.2, <=1.2.3), de.codecentric:spring-boot-admin-sample-discovery (>=1.2.2, <=1.2.3) +27 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.2.5.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - de.codecentric:spring-boot-admin-sample =1.2.2, =1.2.2, =1.2....

com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.apache.camel:camel-example-spring-boot (>=2.16.3, <=2.16.5) +10 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.2.8.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.netflix.spectator:spectator-web-spring =0.41.0, =2.16.3,...

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) +661 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.1.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.6.oss, =1.0.6.oss,...

com.epam.reportportal:commons-bugtracking (3.0.0), com.github.wu191287278:spring-boot-starter-dubbo (1.4.5) +71 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.4.5.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.epam.reportportal:commons-bugtracking 3.0.0 -...

am.ik.home:uaa-server (>=1.3.0, <=1.8.1), br.jus.stf.digital:core (>=0.2.0, <=1.6.0) +79 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.1.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - am.ik.home:uaa-server =1.3.0, =0.2.0, =6.2.0.5, =6.2.0.6,...

io.github.resilience4j:resilience4j-spring-boot (>=0.12.0, <=0.12.1), org.springframework.boot:spring-boot-actuator-docs (1.5.5.release) +3 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.5.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - io.github.resilience4j:resilience4j-spring-boot =0.12.0,...

com.brinkus.labs:labs-cloud-starter-neo4j (1.6.1), com.brinkus.labs:labs-cloud-starter-service (1.6.1) +321 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.7.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.brinkus.labs:labs-cloud-starter-neo4j 1.6.1 -...