spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=6337656974082048 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in Node.js and Spring Data MongoDB

Summary IBM Planning Analytics Workspace is affected by vulnerabilties in Node.js and Spring Data MongoDB CVE-2022-32212, CVE-2022-32213, CVE-2022-32223, CVE-2022-32214, CVE-2022-32222, CVE-2022-32215, CVE-2022-22980 Vulnerability Details CVEID:CVE-2022-32212 DESCRIPTION: Node.js could allow a...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5019995084292096 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=4750279728037888 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=4641864234172416 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5521154232418304 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in java.base/java.lang.String.repeat

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5149854334844928 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5359327821299712 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5836096055672832 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5107868882042880 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.Operator.toStringAST

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5413501158162432 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Detailed Report: https://oss-fuzz.com/testcase?key=4824703051366400 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpMinus.toStringAST

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5849166534541312 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

This Week in Spring - July 26th, 2022

Aloha, Spring fans! Im on vacation, reporting to you from the paradise-like island of Maui, Hawaii, and hoping that youre having a wonderful day! My family and I love Hawaii. Its brimming with beauty and serenity, and while the island of Maui, in the state of Hawaii, is very small, the islands ar...

CVE-2022-22980

A flaw was found in the Spring Data MongoDB. This flaw allows an attacker to perform code injection when an application uses some annotations/query methods with Spring Expression Language SpEL expressions...

GHSA-W24X-87MR-4R23 SpEL Injection in Spring Data MongoDB

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized...

org.springframework.data:spring-data-mongodb-cross-store (2.1.7.release), org.springframework.integration:spring-integration-mongodb (5.1.5.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

com.eurodyn.qlack.util:qlack-util-data-mongo (>=3.0.0, <=3.1.2), com.github.eagle6688:devutility.external.mongo (>=2.1.4, <=2.1.5) +37 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.6.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.eurodyn.qlack.util:qlack-util-data-mongo =3.0.0, =2.1.4,...

com.github.jknack:mwa-mongo (>=0.4.1, <=0.4.2), com.github.jknack:mwa-morphia (>=0.4.1, <=0.4.2) +7 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.3.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.jknack:mwa-mongo =0.4.1, =0.4.1, =4.1.0, =3.0.6,...

org.sentilo.agent:sentilo-agent-activity-monitor (1.7.0), org.sentilo.agent:sentilo-agent-alert (1.7.0) +4 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.3.5.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.sentilo.agent:sentilo-agent-activity-monitor 1.7.0 -...