A Bootiful Podcast: Spring Batch lead Mahmoud Ben Hassine on the latest and greatest in 2023

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! In this installment, Josh Long @starbuxman talks to Spring Batch lead Mahmoud Ben Hassine @FMBENHASSINE about the latest and greatest in Spring Batch. notes Submit your talk to SpringOne@Explore, being held August 21-24, 2023,...

This Week in Spring - February 14th, 2023

Hi, Spring fans! It's early Tuesday morning for me. I'm preparing to head to Chicago, Illinois to meet some customers and have myself a grand ol' time in the windy city. I hope you're doing well, I certainly am. A Bootiful Podcast: opensource, Spring Cloud, and Kubernetes maestro Abel Salgado...

This Week in Spring - October 25th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! When last we spoke, I was in Las Vegas, NV, for the JavaOne show. It was amazing! Im in sunny Singapore, then off to Malaysia and Thailand. Its the first time Ive been to any of these places since 2019! How good it is to be...

This Week in Spring - October 18th, 2022

Hi, Spring fans! Howre you doin? Im doin alright! Last week I was in Antwerp, Belgium, for the amazing Devoxx BE show. I did a presentation with my friend and hero James Ward on Spring and Kotlin that was voted third most-liked talk at a show with more than 250 speakers! That was a personal caree...

This Week in Spring - October 11th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! I write this installment as I pack and prepare for my trip to Antwerp, Belgium, for the always-amazing Devoxx show in Antwerp, Belgium. Ive so missed this show over the pandemic and am so looking forward to returning. I hope ...

This Week in Spring - September 27th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Its the last week of September, already! The years more done than not. The days are receding into darkness earlier. And the Pumpkin Spice Lattes are upon us. The darker and colder days are kind of a bummer, but Im stil excite...

This Week in Spring - August 30th, 2022

Hi, Spring fans! How are you? Howre you doin this fine tuesday morning? Im doing well, of course, because this week VMwares tentpole show - VMware Explore - is happening not even a mile from my home, here in San Francisco! And this is just the first one - therell be another show, my favorite show...

Deserialization of Untrusted Data in Spring Batch

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means...

GHSA-4PH4-Q9R5-6WM6 Deserialization of Untrusted Data in Spring Batch

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (5.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (5.1.0) +152 more potentially affected by CVE-2020-5411 via org.springframework.batch:spring-batch-core (>=4.0.0.release, <=4.2.2.release)

org.springframework.batch:spring-batch-core MAVEN version =4.0.0.release, =3.0.0.release, =3.0.0.release, =4.2.0, =4.2.0, =3.0.0-alpha.1, =2020.08.001 and more Source cves: CVE-2020-5411 Source advisory: OSV:GHSA-4PH4-Q9R5-6WM6...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (5.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (5.1.0) +152 more potentially affected by CVE-2020-5411 via org.springframework.batch:spring-batch-core (>=4.0.0.release, <=4.2.2.release)

org.springframework.batch:spring-batch-core MAVEN version =4.0.0.release, =3.0.0.release, =3.0.0.release, =4.2.0, =4.2.0, =3.0.0-alpha.1, =2020.08.001 and more Source cves: CVE-2020-5411 Source advisory: GHSA-4PH4-Q9R5-6WM6...

GHSA-274R-P6V6-FHH4 Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

Cross-site request forgery CSRF vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability...

Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

Cross-site request forgery CSRF vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability...

Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

Stored Cross-site scripting XSS vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality...

GHSA-49MJ-77Q5-QW5G Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

Stored Cross-site scripting XSS vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality...

GHSA-4CJ8-779H-R25H Cross-site Scripting in Pivotal Spring Batch Admin

Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because...

Cross-site Scripting in Pivotal Spring Batch Admin

Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because...

com.mozu:mozu-api-jobs (>=1.0.13, <=1.0.23), org.springframework.cloud.dist:spring-cloud-dataflow-server-yarn-dist (1.0.0.release) +21 more potentially affected by CVE-2018-1229 via org.springframework.batch:spring-batch-admin-manager (1.3.1.release)

org.springframework.batch:spring-batch-admin-manager MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.batch:spring-batch-admin-manager and may be impacted: - com.mozu:mozu-api-jobs =1.0.13, =1.3.1.release,...

gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8), org.springframework.xd:spring-xd-rest-client (>=1.0.3.release, <=1.0.4.release) +2 more potentially affected by CVE-2018-1229 via org.springframework.batch:spring-batch-admin-manager (1.3.0.release)

org.springframework.batch:spring-batch-admin-manager MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.batch:spring-batch-admin-manager and may be impacted: -...

io.oasp.java.modules:oasp4j-batch (>=1.5.0, <=2.6.1), org.springframework.batch:spring-batch-integration (>=3.0.0.release, <=3.0.8.release) +29 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.5.release)

org.springframework:spring-messaging MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - io.oasp.java.modules:oasp4j-batch =1.5.0, =3.0.0.release, =1.1.0.release,...