Security Update for Microsoft Visual Studio Code Spring Boot Tools Extension (CVE-2022-31691)

The Microsoft Visual Studio Code Spring Boot Tools Extension is version 1.39.0 or below. It is, therefore, affected by a remote code execution vulnerability. The extension uses the Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certa...

com.github.vindell:spring-boot-starter-pf4j2 (>=1.0.0.release, <=1.0.1.release), org.pf4j:pf4j-update (>=2.0.0, <=2.1.0) potentially affected by CVE-2023-40826 via org.pf4j:pf4j (2.2.0)

org.pf4j:pf4j MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.github.vindell:spring-boot-starter-pf4j2 =1.0.0.release, =2.0.0, =2.1.0 Source cves: CVE-2023-40826 Source advisory:...

com.github.vindell:spring-boot-starter-pf4j2 (>=1.0.0.release, <=1.0.1.release), org.pf4j:pf4j-update (>=2.0.0, <=2.1.0) potentially affected by CVE-2023-40828 via org.pf4j:pf4j (2.2.0)

org.pf4j:pf4j MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.github.vindell:spring-boot-starter-pf4j2 =1.0.0.release, =2.0.0, =2.1.0 Source cves: CVE-2023-40828 Source advisory:...

com.github.vindell:spring-boot-starter-pf4j2 (>=1.0.0.release, <=1.0.1.release), org.pf4j:pf4j-update (>=2.0.0, <=2.1.0) potentially affected by CVE-2023-40827 via org.pf4j:pf4j (2.2.0)

org.pf4j:pf4j MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.github.vindell:spring-boot-starter-pf4j2 =1.0.0.release, =2.0.0, =2.1.0 Source cves: CVE-2023-40827 Source advisory:...

com.bitplan.dragtop:com.bitplan.dragtop (>=0.0.1, <=0.0.2), com.bitplan.pdfextractor:com.bitplan.pdfextractor (0.0.1) +4 more potentially affected by CVE-2023-40828 via org.pf4j:pf4j (2.4.0)

org.pf4j:pf4j MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.bitplan.dragtop:com.bitplan.dragtop =0.0.1, =5.0.0, =5.0.0, =1.0.2.release, =1.0.6.release Source cves: CVE-2023-40828 Source...

This Week in Spring - August 29th, 2023 - the post SpringOne recovery blog

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm exhausted. Seriously. Last week was mental. If you need me, I'll be over sipping on a tea... But, before that, there's a ton of things to cover from this last week, as always, and there's no rest for the curious, so let's...

My SpringOne 2023 Recap

Hi, Spring fans! Look, it's Monday after the first in-person SpringOne of the 2020s and the first since the pandemic, and, being honest, I'm bushed! Vegas is a dizzying, sensational, overwhelming, exciting experience, and SpringOne is too. But it was worth it. The SpringOne show surpassed all...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONArray.writeTo

Detailed Report: https://oss-fuzz.com/testcase?key=4861338172915712 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Tackling the OAuth2 Client component model in Spring Security

In Spring Security 5, we saw many developments in the OAuth2 story with the introduction of OAuth2 Resource Server and OAuth2 Client into the framework. Today, it is quite convenient to develop applications that are secured by OAuth2 using the features available in OAuth2 Resource Server...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0, <=0.2.0), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.1.0-rc1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.1.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0, =0.1.0, =0.2.0 Source...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0-rc1, <=0.2.0-rc1), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0-rc1, <=0.2.0-rc1) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.2.1-rc1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.2.1-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0-rc1, =0.1.0-rc1,...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.1, <=0.2.1), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.1, <=0.2.1) +2 more potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.2.2-rc1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.2.2-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.1, =0.1.1, =1.1.2, =1.1....

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.2, <=0.2.2), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.2, <=0.2.2) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.2, =0.1.2, =0.2.2 Source cve...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.3, <=0.2.3), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.3, <=0.2.3) +20 more potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.3)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.3, =0.1.3, =2.2.2-incubating...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.4, <=0.2.4), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.4, <=0.2.4) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.4)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.4, =0.1.4, =0.2.4 Source cve...

Mini-Tmall SQL Injection Vulnerability

Mini-Tmall is a Spring Boot-based mini-Tmall mall, fast deployment runtime, suitable for use as a Bijou template. Mini-Tmall suffers from a SQL injection vulnerability, which stems from the fact that incorrect manipulation of the parameter orderBy can lead to sql injection...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.13 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2023-20873

A flaw was found in Spring Boot. This targets specifically 'spring-boot-actuator-autoconfigure' package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONArray.writeTo

Detailed Report: https://oss-fuzz.com/testcase?key=4867254330982400 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...