CVE-2020-5413

Spring Integration framework provides Kryo Codec implementations as an alternative for Java deserialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious cod...

Deserialization of untrusted data

Spring Integration framework provides Kryo Codec implementations as an alternative for Java deserialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious cod...

CVE-2020-5413 Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"

Spring Integration framework provides Kryo Codec implementations as an alternative for Java deserialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious cod...

CVE-2020-5413

Spring Integration framework provides Kryo Codec implementations as an alternative for Java deserialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious cod...

CVE-2020-5413

CVE-2020-5413 affects Spring Integration Kryo-based (de)serialization. When Kryo is configured with default options, unregistered classes can be resolved on demand, enabling deserialization gadgets to execute malicious code during data intake. The provided connected documents confirm the issue an...

CVE-2020-5413: Deserialization of Untrusted Data

Spring Integration framework provides Kryo Codec implementations as an alternative for Java deserialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious cod...

Remote Code Execution (RCE)

Spring Integration Core is vulnerable to remote code execution RCE. It accepts all unregistered classes on demand when Kryo is configured using default options, allowing a malicious class to be deserialized...

CVE-2020-5413

Spring Integration framework provides Kryo Codec implementations as an alternative for Java deserialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious cod...

Kryo Configuration Allows Code Execution with Unknown “Serialization Gadgets”

Spring Integration framework provides Kryo Codec implementations as an alternative for Java deserialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious cod...

PT-2020-4340

Name of the Vulnerable Software and Affected Versions: Spring Integration framework affected versions not specified Description: The issue is related to the Kryo Codec implementations in the Spring Integration framework, which can lead to a deserialization exploit when configured with default...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

Spring Integration Installed

Binary data pivotalsoftwarespringintegrationinstalled.nbin...

Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

org.springframework.integration:spring-integration-samples (1.0.1.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.1.release)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (3.0.0.release)

org.springframework.integration:spring-integration-xml MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0...

org.springframework.integration:spring-integration-samples (1.0.2.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.2.release)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

org.springframework.integration:spring-integration-samples (1.0.1.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.1.release)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

org.springframework.integration:spring-integration-samples (1.0.2.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.2.release)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.1.27-release) +396 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=4.1.5.release, <=4.3.17.release)

org.springframework.integration:spring-integration-xml MAVEN version =4.1.5.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.1.0-release, =1.0.83-rc1, =1.0.83-rc1, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.2.0, =2.4.0 and more Source cves:...

com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...