cn.bridgeli:master-slave-db-selector (>=0.0.1, <=0.0.2), com.avanza.astrix:astrix-spring (>=0.38.1, <=0.43.6) +195 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.1.1.release)

org.springframework:spring-expression MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.bridgeli:master-slave-db-selector =0.0.1, =0.38.1, =0.14.0, =0.14.0,...

ba.jamax.util:jamax-rest (>=1.3.1-release, <=1.3.4-release), be.dnsbelgium:rdap-server (1.1.0) +1133 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.1.6.release)

org.springframework:spring-expression MAVEN version 4.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ba.jamax.util:jamax-rest =1.3.1-release, =0.0.6, =1.0.0, =0.1.0, =0.1.5,...

au.com.dius:pact-jvm-provider-spring_2.11 (>=3.4.0, <=3.5.18), au.com.dius:pact-jvm-provider-spring_2.12 (>=3.5.4-rc.0, <=3.5.18) +195 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.2.0.release)

org.springframework:spring-expression MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - au.com.dius:pact-jvm-provider-spring2.11 =3.4.0, =3.5.4-rc.0, =1.0.0,...

at.chrl:chrl-jms (1.1.0), at.chrl:chrl-orm-spring-integration (1.1.0) +388 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.2.1.release)

org.springframework:spring-expression MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.chrl:chrl-jms 1.1.0 - at.chrl:chrl-orm-spring-integration 1.1.0 -...

au.com.mountain-pass:hyperstate (>=4, <=9), be.nille.jwt:jwt-aspect (1.0.0) +970 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.2.6.release)

org.springframework:spring-expression MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - au.com.mountain-pass:hyperstate =4, =0.0.21, =0.0.21, =0.0.21, =0.0.21,...

ai.superstream:spring-kafka (3.0.1-alpha1), am.ik.access-logger:access-logger (>=0.1.0, <=0.1.5) +3744 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (>=6.0.0, <=6.0.6)

org.springframework:spring-expression MAVEN version =6.0.0, =0.1.0, =0.1.0, =0.1.0, =4.5.0-beta.1, =3.0.0, =2.9.9-rc.2, =0.25.3-rc.11, =0.1.43, =1.1.0, =1.1.0, =1.1.1 - ch.ralscha:extdirectspring 2.0.0 - ch.rasc:sse-eventbus 2.0.0 and more Source cves: CVE-2023-20861 Source advisory:...

com.github.dalet-oss:mongobee (>=1.0.1, <=1.0.4), com.github.mjeanroy:springmvc-mustache (>=0.6.0, <=1.0.0) +146 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.3.27.release)

org.springframework:spring-expression MAVEN version 4.3.27.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.dalet-oss:mongobee =1.0.1, =0.6.0, =0.10.0, =0.10.0, =0.10.0,...

cn.deepbit:deepbit-sdk (8.3.7), cn.deepbit:deepbit-start-mvc (8.3.7) +501 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.3.23.release)

org.springframework:spring-expression MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.deepbit:deepbit-sdk 8.3.7 - cn.deepbit:deepbit-start-mvc 8.3.7 -...

com.github.skeychen:dswork-common-ssosdk (>=9.0.1, <=9.1.1), com.github.skeychen:dswork-config (>=9.0.1, <=9.1.1) +127 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.3.28.release)

org.springframework:spring-expression MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.skeychen:dswork-common-ssosdk =9.0.1, =9.0.1, =9.0.1, =9.0.1,...

com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate (>=2.3.12, <=2.3.20), com.github.fangjinuo.audit:audit-spring (>=2.3.12, <=2.3.20) +129 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.3.29.release)

org.springframework:spring-expression MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.fangjinuo.audit.entityloader:audit-entityloader-resttemplate...

DEBIAN-CVE-2023-20861

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service DoS condition...

Spring Framework security vulnerabilities

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A security vulnerability exists in Spring Framework versions 6.0.0 through 6.0.6, 5.3.0 through 5.3.25, 5.2.0 through 5.2.22, and...

ai.superstream:spring-kafka (3.0.1-alpha1), am.ik.access-logger:access-logger (>=0.1.0, <=0.1.5) +3744 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (>=6.0.0, <=6.0.6)

org.springframework:spring-expression MAVEN version =6.0.0, =0.1.0, =0.1.0, =0.1.0, =4.5.0-beta.1, =3.0.0, =2.9.9-rc.2, =0.25.3-rc.11, =0.1.43, =1.1.0, =1.1.0, =1.1.1 - ch.ralscha:extdirectspring 2.0.0 - ch.rasc:sse-eventbus 2.0.0 and more Source cves: CVE-2023-20861 Source advisory:...

PT-2023-2099

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.2.0.RELEASE through 5.2.22.RELEASE Spring Framework versions 5.3.0 through 5.3.25 Spring Framework versions 6.0.0 through 6.0.6 Description The issue is related to unlimited resource distribution in the Spring...

OSV-2023-214 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57295 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal java.base/java.util.HashMap.get org.springframework.core.convert.TypeDescriptor.valueOf...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=4771286409936896 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

SUSE CVE-2022-22963

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=6703016755724288 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

Nepxion security vulnerabilities

Nepxion Discovery is an enhanced middleware for service registration discovery for Spring Cloud. Nepxion Discovery 6.16.2 and earlier versions are vulnerable to a remote code execution vulnerability that stems from a lack of validation of input data in Discovery-commons and is susceptible to SpEL...

PT-2022-16005 · Nepxion · Nepxion Discovery

Name of the Vulnerable Software and Affected Versions: Nepxion Discovery affected versions not specified Description: The issue is related to SpEL Injection in discovery-commons, where the DiscoveryExpressionResolver’s eval method evaluates expressions with a StandardEvaluationContext. This allow...