Tmall_demo SQL injection vulnerability

Tmalldemo is a Spring Boot-based mini Tmall by the Xianqi Mall projectteam team. A SQL injection vulnerability exists in Tmalldemo 20240901 and earlier versions, which stems from the improper handling of the orderBy parameter in the orderMapper.select function in the tmall/admin/order/1/1 file...

Spring Boot CDS support and Project Leyden anticipation

How can Spring Boot developers improve the runtime efficiency of their applications with minimal constraints in order to enjoy those benefits on most applications? The answer is the CDS support introduced by Spring Boot 3.3 which allows you to start your Spring Boot applications faster and consum...

This Week in Spring - August 27th, 2024 - SpringOne 2024 edition

Hi, Spring fans, from the expo hall of SpringOne at VMware Explore 2024! There's a livestream of some of the key talks - register and watch for free now at SpringOne.io. Right now I'm hanging out at the expo hall manning a booth and doing demos to the hoardes of people streaming by, but I'll be...

com.alipay.sofa:ark-sofa-boot (4.1.0), com.alipay.sofa:ark-sofa-boot-starter (4.1.0) +2 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.1.0, <=3.1.12)

org.springframework.boot:spring-boot-loader MAVEN version =3.1.0, =4.0.0-rc1, =3.1.0, =3.1.12 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=1.0.0, <=1.4.2), com.alipay.sofa.koupleless:koupleless-base-starter (>=1.0.0, <=1.4.2) +85 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-loader MAVEN version =2.7.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.5.1, =0.5.1, =2.2.4, =2.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2024-38807 Source advisory:...

io.zipkin:zipkin-server (>=3.3.1, <=3.4.1), org.springframework.boot:spring-boot-jarmode-tools (>=3.3.0, <=3.3.2) potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader-classic (>=3.3.0, <=3.3.2)

org.springframework.boot:spring-boot-loader-classic MAVEN version =3.3.0, =3.3.1, =3.3.0, =3.3.2 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...

io.zipkin:zipkin-server (>=3.3.1, <=3.4.1), org.springframework.boot:spring-boot-jarmode-tools (>=3.3.0, <=3.3.2) potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader-classic (>=3.3.0, <=3.3.2)

org.springframework.boot:spring-boot-loader-classic MAVEN version =3.3.0, =3.3.1, =3.3.0, =3.3.2 Source cves: CVE-2024-38807 Source advisory: GHSA-7CJ3-X93G-GJ76...

com.tencent.devops:devops-boot-starter-plugin (1.0.0), com.tencent.devops:devops-plugin-core (1.0.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.3.1, <=3.3.2)

org.springframework.boot:spring-boot-loader MAVEN version =3.3.1, =3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-loader and may be impacted: - com.tencent.devops:devops-boot-starter-plugin 1.0.0 -...

com.tencent.devops:devops-boot-starter-plugin (1.0.0), com.tencent.devops:devops-plugin-core (1.0.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.3.1, <=3.3.2)

org.springframework.boot:spring-boot-loader MAVEN version =3.3.1, =3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-loader and may be impacted: - com.tencent.devops:devops-boot-starter-plugin 1.0.0 -...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=2.1.0, <=2.1.11), com.alipay.sofa.koupleless:koupleless-base-starter (>=2.1.0, <=2.1.11) +8 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.2.0, <=3.2.7)

org.springframework.boot:spring-boot-loader MAVEN version =3.2.0, =2.1.0, =2.1.0, =4.2.0, =4.2.0, =3.1.0, =0.4.0, =4.3.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=2.1.0, <=2.1.11), com.alipay.sofa.koupleless:koupleless-base-starter (>=2.1.0, <=2.1.11) +8 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.2.0, <=3.2.7)

org.springframework.boot:spring-boot-loader MAVEN version =3.2.0, =2.1.0, =2.1.0, =4.2.0, =4.2.0, =3.1.0, =0.4.0, =4.3.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa:ark-sofa-boot (4.1.0), com.alipay.sofa:ark-sofa-boot-starter (4.1.0) +2 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.1.0, <=3.1.12)

org.springframework.boot:spring-boot-loader MAVEN version =3.1.0, =4.0.0-rc1, =3.1.0, =3.1.12 Source cves: CVE-2024-38807 Source advisory: GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=2.0.0, <=2.0.4), com.alipay.sofa.koupleless:koupleless-base-starter (>=2.0.0, <=2.0.4) +11 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.0.0, <=3.0.13)

org.springframework.boot:spring-boot-loader MAVEN version =3.0.0, =2.0.0, =2.0.0, =4.0.0-m2, =4.0.0-m2, =3.0.0, =0.0.1, =4.0.0-m1, =3.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=2.0.0, <=2.0.4), com.alipay.sofa.koupleless:koupleless-base-starter (>=2.0.0, <=2.0.4) +11 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=3.0.0, <=3.0.13)

org.springframework.boot:spring-boot-loader MAVEN version =3.0.0, =2.0.0, =2.0.0, =4.0.0-m2, =4.0.0-m2, =3.0.0, =0.0.1, =4.0.0-m1, =3.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2024-38807 Source advisory: GHSA-7CJ3-X93G-GJ76...

com.alipay.sofa.koupleless:arklet-springboot-starter (>=1.0.0, <=1.4.2), com.alipay.sofa.koupleless:koupleless-base-starter (>=1.0.0, <=1.4.2) +85 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-loader MAVEN version =2.7.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.5.1, =0.5.1, =2.2.4, =2.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2024-38807 Source advisory:...

io.americanexpress.synapse:sample-function-greeter-gcp (>=0.4.0, <=0.4.10), io.zipkin:zipkin-server (>=3.0.0, <=3.3.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader-classic (>=3.2.0, <=3.2.8)

org.springframework.boot:spring-boot-loader-classic MAVEN version =3.2.0, =0.4.0, =3.0.0, =3.2.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: OSV:GHSA-7CJ3-X93G-GJ76...

io.americanexpress.synapse:sample-function-greeter-gcp (>=0.4.0, <=0.4.10), io.zipkin:zipkin-server (>=3.0.0, <=3.3.0) +3 more potentially affected by CVE-2024-38807 via org.springframework.boot:spring-boot-loader-classic (>=3.2.0, <=3.2.8)

org.springframework.boot:spring-boot-loader-classic MAVEN version =3.2.0, =0.4.0, =3.0.0, =3.2.0, =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2024-38807 Source advisory: GHSA-7CJ3-X93G-GJ76...

GHSA-7CJ3-X93G-GJ76 Signature forgery in Spring Boot's Loader

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another...

Signature forgery in Spring Boot's Loader

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another...

CVE-2024-38807

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another...