Paketo Buildpacks Bionic End Of Support

The Spring Boot plugins for Maven and Gradle provide the ability to build Docker images using Cloud Native Buildpacks. By default, Spring Boot uses the CNB builders provided by the Paketo Buildpacks project. What's Changed The Paketo Buildpacks project has announced that Ubuntu 18.04 Bionic-based...

Spring Tips: Making the joyful jump to Java 21

Hi, Spring fans! Java 21 and GraalVM supporting Java 21 are at long last here! It's been a long time in coming, but Java 21 - which comes out later today on the 19th of September, 2023 - brings with it some of the most exciting new features of any Java release. In this video, I will look at some ...

This Week in Spring - September 19th, 2023 (Java 21 Edition)

Hi, Spring fans! Welcome to another installment of This Week in Spring - Java 21 edition! The big news, indeed, the biggest news, is that Java 21 is now available here! You should use SDKMAN to install it, like this: sdk install java 21-graalce && sdk default java 21-graalce. This install givews...

com.github.gmcoringa:coordinator (0.0.1), io.undertow:undertow-servlet (1.1.3.final) +4 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (1.1.3.final)

io.undertow:undertow-core MAVEN version 1.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.gmcoringa:coordinator 0.0.1 - io.undertow:undertow-servlet 1.1.3.final -...

io.undertow:undertow-servlet (1.1.9.final), io.undertow:undertow-websockets-jsr (1.1.9.final) +1 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (1.1.9.final)

io.undertow:undertow-core MAVEN version 1.1.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.9.final - io.undertow:undertow-websockets-jsr 1.1.9.final -...

com.fitbur.testify.examples:example-junit-springboot-systemtest (>=0.1.0, <=0.1.3), com.github.almex:raildelays-assembly-descriptor (>=2.0.0-beta.1, <=2.0.0-beta.2) +5 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (1.3.14.final)

io.undertow:undertow-core MAVEN version 1.3.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.fitbur.testify.examples:example-junit-springboot-systemtest =0.1.0, =2.0.0-beta.1, =2.0.0-beta.1,...

com.pep1:pep1-commons-rest (0.6), io.syndesis:http-pull-push-example (>=0.4.2, <=0.4.5) +5 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (1.3.27.final)

io.undertow:undertow-core MAVEN version 1.3.27.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.pep1:pep1-commons-rest 0.6 - io.syndesis:http-pull-push-example =0.4.2, =0.4.2, =0.4.2, =0.4.5 -...

com.github.jmjlbmn:huiche-demo (>=1.0.1, <=1.0.5), com.github.jmjlbmn:huiche-spring-boot-starter (>=1.0.1, <=1.0.6) +124 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (1.4.22.final)

io.undertow:undertow-core MAVEN version 1.4.22.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.jmjlbmn:huiche-demo =1.0.1, =1.0.1, =1.0.1.release, =0.5.0, =1.5.8, =1.3.1, =4.10.0-beta2,...

Lenosp Code Issues Vulnerabilities

Lenosp is a Spring Boot 2.0 rapid development modular scaffolding organized by Zhengzhou Programmers zzdevelop in China. A security vulnerability exists in Lenosp versions 1.0.0 to 1.2.0. The vulnerability stems from an arbitrary file upload vulnerability in the /user/upload component, which allo...

Important: Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.20.2 release and security update

Red Hat Integration Camel for Spring Boot 3.20.2 release and security update is now available. Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry

A flaw was found in Spring Boot. This targets specifically 'spring-boot-actuator-autoconfigure' package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are...

Important: Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.18.3.2 release and security update

Red Hat Integration Camel for Spring Boot 3.18.3.2 release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having an impact of Important. A Common...

This Week in Spring - September 12th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you this fine 12th of September? I'm doing alright, elated, even. I've just returned from beautiful Oslo, Norway, and I've got a busy 30 days or so ahead, starting today. I'm visiting Seattle, WA; Mexico City, Mexico;...

cn.hutool:hutool-dfa (4.0.9), cn.hutool:hutool-http (4.0.9) +2 more potentially affected by CVE-2023-42277 via cn.hutool:hutool-json (4.0.9)

cn.hutool:hutool-json MAVEN version 4.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-dfa 4.0.9 - cn.hutool:hutool-http 4.0.9 - cn.virens:virens-util =1.0.7, =1.1.1 -...

cn.hutool:hutool-dfa (4.0.9), cn.hutool:hutool-http (4.0.9) +2 more potentially affected by CVE-2023-42278 via cn.hutool:hutool-json (4.0.9)

cn.hutool:hutool-json MAVEN version 4.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-dfa 4.0.9 - cn.hutool:hutool-http 4.0.9 - cn.virens:virens-util =1.0.7, =1.1.1 -...

cn.hutool:hutool-dfa (4.0.9), cn.hutool:hutool-http (4.0.9) +2 more potentially affected by CVE-2023-42276 via cn.hutool:hutool-json (4.0.9)

cn.hutool:hutool-json MAVEN version 4.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-dfa 4.0.9 - cn.hutool:hutool-http 4.0.9 - cn.virens:virens-util =1.0.7, =1.1.1 -...

All together now: Spring Boot 3.2, GraalVM native images, Java 21, and virtual threads with Project Loom,

This has been a very long time in coming, but finally we can create GraalVM native images that use Spring Boot via Spring Boot 3.2 and Java 21's virtual threads Project Loom! Why does all this matter? Each of these individual things, Project Loom, and GraalVM native images, offer compelling runti...

Important: Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.4 security update

An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which provides a detailed severity rating, is available for each vulnerability from th...

spring-boot: Spring Boot Welcome Page DoS Vulnerability

A flaw was found in Spring Boot, occurring prominently in Spring MVC with a reverse proxy cache. This issue requires Spring MVC to have auto-configuration enabled and the application to use Spring Boot's welcome page support, either static or templated, resulting in the application being deployed...

Security Bulletin: IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities

Summary IBM Cloud Pak for Network Automation 2.6 addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2022-25647 DESCRIPTION: Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the...