A Bootiful Podcast: Spring Batch lead Mahmoud Ben Hassine on the latest and greatest in 2023

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! In this installment, Josh Long @starbuxman talks to Spring Batch lead Mahmoud Ben Hassine @FMBENHASSINE about the latest and greatest in Spring Batch. notes Submit your talk to SpringOne@Explore, being held August 21-24, 2023,...

My-Blog Cross-Site Scripting Vulnerabilities

My-Blog is a Java blog system implemented by SpringBoot + Mybatis + Thymeleaf and other technologies, with beautiful pages, full functionality, easy deployment and perfect code. My-Blog has a security vulnerability. An attacker can exploit this vulnerability to cause a denial of service via the...

This Week in Spring - February 28th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm writing this installment from a hotel room in Dallas, Texas, in the USA. Last night I had the privilege of hanging out with some of my friends from the local Java scene. Today I meet with customers. It's going to be a nic...

Spring Cloud Function for Azure Function

What is the Spring Cloud Function? Spring Cloud Function is a SpringBoot-based framework allowing users to concentrate on their business logic by implementing them as Java Functions i.e., Supplier, Function, Consumer. In turn the framework provides necessary abstraction to enable execution of the...

io.undertow:undertow-servlet (1.1.7.final), io.undertow:undertow-websockets-jsr (1.1.7.final) +1 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.1.7.final)

io.undertow:undertow-core MAVEN version 1.1.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.7.final - io.undertow:undertow-websockets-jsr 1.1.7.final -...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

io.undertow:undertow-servlet (1.1.9.final), io.undertow:undertow-websockets-jsr (1.1.9.final) +1 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.1.9.final)

io.undertow:undertow-core MAVEN version 1.1.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.9.final - io.undertow:undertow-websockets-jsr 1.1.9.final -...

com.github.gmcoringa:coordinator (0.0.1), io.undertow:undertow-servlet (1.1.3.final) +4 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.1.3.final)

io.undertow:undertow-core MAVEN version 1.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.gmcoringa:coordinator 0.0.1 - io.undertow:undertow-servlet 1.1.3.final -...

From Spring Native to Spring Boot 3

Today, we are finishing to transition the Spring support for building native executables from the experimental Spring Native project to the official Spring Boot GraalVM native image support. In practice, that means we are archiving the Spring Native GitHub repository and moving it to the...

SUSE CVE-2017-8046

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 Ingalls SR9, versions prior to 3.0.1 Kay SR1 and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code...

SUSE CVE-2018-15756

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

SUSE CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...

A Bootiful Podcast: opensource, Spring Cloud, and Kubernetes maestro Abel Salgado Romero

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Abel Salgado Romero @abelsromero about open source, Kubernetes, and building Kubernetes controllers with Spring Boot and GraalVM native images...

This Week in Spring - February 7th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's Tuesday, February 7th, 2023, as I write this and I'm so very glad to be talking to you. How're you doin'? Some housekeeping: I'll be doing more live streams over on my YT channel - join me and we'll talk shop. I'm going...

Moderate: Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.2.SP1 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

com.github.tuhe32:seed-spring-boot-starter (>=0.1.2, <=0.1.4) potentially affected by CVE-2023-24163 via cn.hutool:hutool-all (4.4.3)

cn.hutool:hutool-all MAVEN version 4.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-all and may be impacted: - com.github.tuhe32:seed-spring-boot-starter =0.1.2, =0.1.4 Source cves: CVE-2023-24163 Source advisory:...

com.gitee.nuliing:ben-api (1.0.0), com.github.llyb120:nami (1.1.5-release) +3 more potentially affected by CVE-2023-24162 via cn.hutool:hutool-all (4.5.3)

cn.hutool:hutool-all MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-all and may be impacted: - com.gitee.nuliing:ben-api 1.0.0 - com.github.llyb120:nami 1.1.5-release - com.github.shuaidd:qywx-spring-boot-api =1.0....

com.github.tuhe32:seed-spring-boot-starter (>=0.1.2, <=0.1.4) potentially affected by CVE-2023-24162 via cn.hutool:hutool-all (4.4.3)

cn.hutool:hutool-all MAVEN version 4.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-all and may be impacted: - com.github.tuhe32:seed-spring-boot-starter =0.1.2, =0.1.4 Source cves: CVE-2023-24162 Source advisory:...

cn.jiangzeyin.fast-boot:common-boot (>=1.2.24, <=1.2.27), cn.jiangzeyin.fast-boot:common-redis (>=1.2.24, <=1.2.27) +3 more potentially affected by CVE-2023-24163 via cn.hutool:hutool-all (4.4.5)

cn.hutool:hutool-all MAVEN version 4.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-all and may be impacted: - cn.jiangzeyin.fast-boot:common-boot =1.2.24, =1.2.24, =1.0.2-rc.7, =1.0.0, =0.0.1, =1.0.2 Source cves: CVE-2023-24163...

Important: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.14.5 Patch 1 release and security update

A patch is now available for Camel for Spring Boot 3.14.5. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS bas...