GHSA-WR5R-M8PC-85J9 Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (3.0.0.release)

org.springframework.integration:spring-integration-ws MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0.1...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.1.27-release) +396 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=4.1.5.release, <=4.3.17.release)

org.springframework.integration:spring-integration-xml MAVEN version =4.1.5.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.1.0-release, =1.0.83-rc1, =1.0.83-rc1, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.2.0, =2.4.0 and more Source cves:...

org.springframework.integration:spring-integration-samples (1.0.2.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.2.release)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.1.27-release) +20 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=4.2.0.release, <=4.3.17.release)

org.springframework.integration:spring-integration-ws MAVEN version =4.2.0.release, =1.0.110-release, =1.0.111-release, =1.0.111-release, =1.1.0-release, =1.0.111-release, =1.0.111-release, =1.0.0, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.4.0 and...

com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.111-release, <=1.1.27-release) +20 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=4.2.0.release, <=4.3.17.release)

org.springframework.integration:spring-integration-ws MAVEN version =4.2.0.release, =1.0.110-release, =1.0.111-release, =1.0.111-release, =1.1.0-release, =1.0.111-release, =1.0.111-release, =1.0.0, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.4.0 and...

org.springframework.integration:spring-integration-samples (1.0.1.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.1.release)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

org.springframework.integration:spring-integration-samples (1.0.2.sr1) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.2.sr1)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.2.sr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

cloud.altemista.fwk.integration:cloud-altemistafwk-core-integration-ws-conf (>=3.0.0.release, <=3.0.1.release), com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.2.6-release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=5.0.1.release, <=5.0.7.release)

org.springframework.integration:spring-integration-ws MAVEN version =5.0.1.release, =3.0.0.release, =2.0.0-rc1, =2.2.6-release Source cves: CVE-2019-3772 Source advisory: GHSA-WR5R-M8PC-85J9...

Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...

org.springframework.integration:spring-integration-samples (1.0.2.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.2.release)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.1.36-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.1.27-release) +396 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=4.1.5.release, <=4.3.17.release)

org.springframework.integration:spring-integration-xml MAVEN version =4.1.5.release, =1.0.83-rc1, =1.0.88-rc1, =1.0.83-rc1, =1.1.0-release, =1.0.83-rc1, =1.0.83-rc1, =1.0.0-rc1, =1.0.5-release, =1.2.23-release, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =2.0.0, =2.2.0, =2.4.0 and more Source cves:...

com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.1.6-release), org.springframework.cloud.stream.app:aggregate-counter-app-starters-build (>=2.0.0.release, <=2.0.2.release) +294 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (>=5.0.1.release, <=5.0.9.release)

org.springframework.integration:spring-integration-xml MAVEN version =5.0.1.release, =2.0.0-rc1, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2...

org.springframework.integration:spring-integration-samples (1.0.1.release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (1.0.1.release)

org.springframework.integration:spring-integration-ws MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: -...

org.springframework.integration:spring-integration-samples (1.0.2.sr1) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (1.0.2.sr1)

org.springframework.integration:spring-integration-xml MAVEN version 1.0.2.sr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: -...

cloud.altemista.fwk.integration:cloud-altemistafwk-core-integration-ws-conf (>=3.0.0.release, <=3.0.1.release), com.themodernway:themodernway-server-integration (>=2.0.0-rc1, <=2.2.6-release) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (>=5.0.1.release, <=5.0.7.release)

org.springframework.integration:spring-integration-ws MAVEN version =5.0.1.release, =3.0.0.release, =2.0.0-rc1, =2.2.6-release Source cves: CVE-2019-3772 Source advisory: OSV:GHSA-WR5R-M8PC-85J9...

nz.co.senanque:madura-workflow (>=0.0.3, <=1.0.1), nz.co.senanque:madura-workflow-ui (1.0.1) +4 more potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-xml (3.0.0.release)

org.springframework.integration:spring-integration-xml MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-xml and may be impacted: - nz.co.senanque:madura-workflow =0.0.3, =1.0...

com.github.ptomli.bedrock:bedrock-core (1.0.0) potentially affected by CVE-2019-3772 via org.springframework.integration:spring-integration-ws (2.2.1.release)

org.springframework.integration:spring-integration-ws MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ws and may be impacted: - com.github.ptomli.bedrock:bedrock-core 1.0.0...

CVE-2019-3772

Spring Integration spring-integration-xml and spring-integration-ws modules, versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...