ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-apache (>=6.2.0, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-spring-boot-sample-client-okhttp (>=6.2.0, <=6.4.7) +1714 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.7.0, <=2.7.10)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.7.0, =6.2.0, =6.2.0, =6.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 - cc.zhaoac:faith-tool-boot 1.1.0 - cc.zhaoac:faith-tool-common 1.1.0 - cc.zhaoac:faith-tool-launch 1.1.0 and more Sourc...

cc.vihackerframework:vihacker-auth-starter (1.0.8.r), cc.vihackerframework:vihacker-common-starter (1.0.8.r) +769 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=3.0.0, <=3.0.5)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =3.0.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-20873 Source advisory: MEND:CVE-2023-20873...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +5550 more potentially affected by CVE-2023-20873 via org.springframework.boot:spring-boot-actuator-autoconfigure (>=2.0.0.release, <=2.5.14)

org.springframework.boot:spring-boot-actuator-autoconfigure MAVEN version =2.0.0.release, =0.1.2, =0.5.0, =0.5.21, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2023-20873 Source advisory: MEND:CVE-2023-20...

CVE-2023-20873

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users...

CVE-2023-20873

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.6+. 2.7.x users...

This Week in Spring - April 18th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week, I just returned from Western Europe for Devoxx FR Paris and Kotlin Conf Amsterdam. I went home, saw my family, did some laundry, and then turned right back around to head to Chicago, Illinois, for a special joint...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.12), ai.houyi:dorado (>=0.0.6, <=0.0.8) +1474 more potentially affected by CVE-2023-20863 via org.springframework:spring-expression (4.3.18.release)

org.springframework:spring-expression MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter =0.1.10, =0.0.6, =0.0.1...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2023-20863 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

A Bootiful Podcast: Sonatype's Steve Poole and Gradle's Justin Reock on Improving Developer Productivity without compromising on things like security

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In this installment, recorded at Devnexus in Atlanta, GA, I talk to newcomer to the show Steve Poole, from Sonatype, and Justin Reock, from Gradle, about improving developer productivity without comprising on things like...

A Bootiful Podcast: José Paumard, Java Champion alumnus and Java legend, on Project Loom, Valhalla, and more, from Devnexus 2023!

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast. In this installment I'll talk to legendary Oracle Java Champion alumnus, Java advocate, professor emeritus, and all around amiable fellow José Paumard, recorded at the amazing Devnexus 2023 event! José's English-language Youtu...

com.baomidou:mybatisplus-spring-boot-starter (1.0.3) potentially affected by CVE-2023-25330 via com.baomidou:mybatis-plus (2.1-beta)

com.baomidou:mybatis-plus MAVEN version 2.1-beta is affected by a known vulnerability. The following packages have a transitive dependency on com.baomidou:mybatis-plus and may be impacted: - com.baomidou:mybatisplus-spring-boot-starter 1.0.3 Source cves: CVE-2023-25330 Source advisory:...

com.baomidou:mybatisplus-spring-boot-starter (1.0.2) potentially affected by CVE-2023-25330 via com.baomidou:mybatis-plus (2.0.9)

com.baomidou:mybatis-plus MAVEN version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on com.baomidou:mybatis-plus and may be impacted: - com.baomidou:mybatisplus-spring-boot-starter 1.0.2 Source cves: CVE-2023-25330 Source advisory:...

A Bootiful Podcast: Spring Integration lead Artem Bilan on the latest in Spring Integration 6

Hi, Spring fans! In this installment Josh Long @starbuxman talks to Spring Integration lead Artem Bilan @artembilan about the latest and greatest in Spring Integration. Spring Integration makes it easier to connect an increasingly larger ecosystem of disparate services and systems. SHOW NOTES: I...

This Week in Spring - March 28th, 202

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm reporting to you from Los Angeles, where my family and I have gone for my daughter's spring break. We're going to survey some prospective colleges and we're going to Disneyland. Needless to say, I'm doubly glad to have al...

Context Propagation with Project Reactor 1 - The Basics

This post is a part of a series: 1. The Basics 2. The bumpy road of Spring Cloud Sleuth 3. Unified Bridging between Reactive and Imperative Spring Boot 3 and Spring Framework 6 brought us a unified and consistent way to enable Observability in applications that use Micrometer. The evolution from...

br.com.ideotech:draw-out-spring-boot-aop (>=1.5.19.release, <=1.5.19-4.release), br.com.ideotech:draw-out-spring-boot-lib (>=1.5.19.release, <=1.5.19-4.release) +796 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.3.22.release)

org.springframework:spring-expression MAVEN version 4.3.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - br.com.ideotech:draw-out-spring-boot-aop =1.5.19.release, =1.5.19.release,...

co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +156 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.0.8.release)

org.springframework:spring-expression MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

A Bootiful Podcast: Mark Thomas, Apache Tomcat contributor extraordinaire

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! In this installment, Josh Long talks to longtime Apache Tomcat contributor extraordinaire Mark Thomas I wrote a free white paper on using Spring Boot 3 AOT and GraalVM. Learn the secrets to working with Spring Boot 3 and Graal...

This Week in Spring - March 21st, 2023

Hi, Spring fans! Welcome to another rip roaring installment of This Week in Spring! It's March 21st and today they announced Java 20! It's an exciting time to be a Java developer. Java 20, of course, is just another amazing installment before Java 21, which comes out in six short months, includin...

Spring Tips: Vaadin Flow and Spring Boot 3

Hi, Spring fans! In this installment, we'll look at the fantastic Vaadin Flow library, which has recently been updated for Spring Boot 3, and how it can help you be happier. the code is available, as usual, here this episode features special guest Marcus Hellberg, VP developer relations from...