Important: Red Hat Security Advisory: Red Hat Fuse 7.7.0 release and security update

A minor version update from 7.6 to 7.7 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

spring-data-api: potential information disclosure through maliciously crafted example value in ExampleMatcher

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

Important: Red Hat Security Advisory: Red Hat Fuse 7.6.0 security update

A minor version update from 7.5 to 7.6 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

Spring Data Commons Installed

Binary data pivotalsoftwarespringdatacommonsinstalled.nbin...

Spring Data REST Installed

Binary data pivotalsoftwarespringdatarestinstalled.nbin...

Spring Data JPA Installed

Binary data pivotalsoftwarespringdatajpainstalled.nbin...

CVE-2018-1273

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

Improper Neutralization of Wildcards or Matching Symbols

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

bd.ac.seu.erp:model (0.0.2), ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.5.0, <=3.6.0) +582 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.0.0.release, <=2.0.14.release)

org.springframework.data:spring-data-jpa MAVEN version =2.0.0.release, =3.5.0, =3.5.0, =3.5.0, =0.9.1-rc1, =3.0.0.release, =3.0.1.release - cn.bjdd301:core-mvc 1.0.0 - cn.com.zhaoweiping:alpha-framework 2.0.0.release - cn.jbone:jbone-common 1.0.0 - cn.jbone:jbone-errors 1.0.0 -...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1129 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=1.0.1.release, <=1.11.21.release)

org.springframework.data:spring-data-jpa MAVEN version =1.0.1.release, =1.0.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2019-3802 Source advisory:...

ai.hyacinth.framework:core-service-jpa-support (0.5.0), ai.hyacinth.framework:core-service-trigger-server (0.5.0) +512 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.1.0.release, <=2.1.7.release)

org.springframework.data:spring-data-jpa MAVEN version =2.1.0.release, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =3.8.0 - ch.puzzle:libpuzzle-demo-spring-boot-rest 0.1.0-rc1 and more Source cves: CVE-2019-3802 Source advisory: GHSA-XGGX-FX6W-V7CH...

GHSA-XGGX-FX6W-V7CH Improper Neutralization of Wildcards or Matching Symbols

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

ai.hyacinth.framework:core-service-jpa-support (0.5.0), ai.hyacinth.framework:core-service-trigger-server (0.5.0) +974 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=2.0.0.release, <=2.1.7.release)

org.springframework.data:spring-data-jpa MAVEN version =2.0.0.release, =3.5.0, =3.6.0, =3.5.0, =3.5.0, =3.8.0 and more Source cves: CVE-2019-3802 Source advisory: OSV:GHSA-XGGX-FX6W-V7CH...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1129 more potentially affected by CVE-2019-3802 via org.springframework.data:spring-data-jpa (>=1.0.1.release, <=1.11.21.release)

org.springframework.data:spring-data-jpa MAVEN version =1.0.1.release, =1.0.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2019-3802 Source advisory:...

Design/Logic Flaw

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802

CVE-2019-3802 affects Spring Data JPA up to versions 2.1.6, 2.0.14, and 1.11.20. Affected component is ExampleMatcher using StringMatcher.STARTING, StringMatcher.ENDING, or StringMatcher.CONTAINING, where crafted example values could return more results than intended. Multiple connected sources c...

CVE-2019-3802

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...

CVE-2019-3802 Additional information exposure with Spring Data JPA example matcher

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted...