spring-data-keyvalue:KeyValueTemplateFuzzer: Security exception in java.base/jdk.internal.misc.Unsafe.allocateUninitializedArray0

Project: https://github.com/spring-projects/spring-data-keyvalue.git Detailed Report: https://oss-fuzz.com/testcase?key=5153566394548224 Project: spring-data-keyvalue Fuzzing Engine: libFuzzer Fuzz Target: KeyValueTemplateFuzzer Job Type: libfuzzerasanspring-data-keyvalue Platform Id: linux Crash...

spring-data-keyvalue:KeyValueTemplateFuzzer: Security exception in java.base/java.lang.String.repeat

Project: https://github.com/spring-projects/spring-data-keyvalue.git Detailed Report: https://oss-fuzz.com/testcase?key=4959233536032768 Project: spring-data-keyvalue Fuzzing Engine: libFuzzer Fuzz Target: KeyValueTemplateFuzzer Job Type: libfuzzerasanspring-data-keyvalue Platform Id: linux Crash...

This Week in Spring - November 8th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Ive been busy this last week! Ive been visiting with customers and talking to the community here in South East Asia. I was in Malaysia last week, and now Im in Bangkok, Thailand. Im near the end of my time here in SE Asia,...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in java.base/java.lang.String.repeat

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5149854334844928 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5359327821299712 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5836096055672832 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5107868882042880 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.Operator.toStringAST

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5413501158162432 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Detailed Report: https://oss-fuzz.com/testcase?key=4824703051366400 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpMinus.toStringAST

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5849166534541312 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

This Week in Spring - October 18th, 2022

Hi, Spring fans! Howre you doin? Im doin alright! Last week I was in Antwerp, Belgium, for the amazing Devoxx BE show. I did a presentation with my friend and hero James Ward on Spring and Kotlin that was voted third most-liked talk at a show with more than 250 speakers! That was a personal caree...

Spring at JavaOne 2022

Hi, Spring fans! Its Sunday the 16th of October as I write this and Im winging my way to sunny Las Vegas, Nevada, where Ill be attending and presenting at the first JavaOne show in years! It didnt exist as the JavaOne we know and love for years, even before the pandemic interrupted life as we kno...

spring-data-redis:GenericJackson2JsonRedisSerializerFuzzer: Security exception in com.fasterxml.jackson.databind.type.TypeParser.parseType

Project: https://github.com/spring-projects/spring-data-redis.git Detailed Report: https://oss-fuzz.com/testcase?key=4918344772091904 Project: spring-data-redis Fuzzing Engine: libFuzzer Fuzz Target: GenericJackson2JsonRedisSerializerFuzzer Job Type: libfuzzerasanspring-data-redis Platform Id:...

spring-data-redis:GenericJackson2JsonRedisSerializerFuzzer: Security exception in jaz.Zer.<clinit>

Detailed Report: https://oss-fuzz.com/testcase?key=5664501471248384 Project: spring-data-redis Fuzzing Engine: libFuzzer Fuzz Target: GenericJackson2JsonRedisSerializerFuzzer Job Type: libfuzzerasanspring-data-redis Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Information Disclosure

spring-data-rest-webmvc is vulnerable to information disclosure. The vulnerability exists due to the improper implementation of the JSON patch in the library, allowing an attacker to get information about the hidden entity attributes through maliciously crafted HTTP requests...

Spring Data REST can expose hidden entity attributes

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

app.commerce-io:spring-boot-starter-data-search-jpa (1.3.0), be.personify.iam:personify-api (>=1.3.2.release, <=1.4.4.release) +37 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.6.0, <=3.6.6)

org.springframework.data:spring-data-rest-core MAVEN version =3.6.0, =1.3.2.release, =1.3.1.release, =1.3.1.release, =1.2.6.release, =1.2.7, =1.2.7, =1.2.7, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 and more Source cves: CVE-2022-31679 Source advisory: GHSA-FV7X-V67W-CVQV...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: OSV:GHSA-FV7X-V67W-CVQV...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: GHSA-FV7X-V67W-CVQV...

GHSA-FV7X-V67W-CVQV Spring Data REST can expose hidden entity attributes

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...