This Week in Spring - August 22, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! And, would you believe it, I'm writing this at SpringOne 2023, in sunny Las Vegas, Nevada. This is the first in-person SpringOne since 2019, and I'm so, so, so glad to be here! We've got a ton of things to get into this week,...

Tackling the OAuth2 Client component model in Spring Security

In Spring Security 5, we saw many developments in the OAuth2 story with the introduction of OAuth2 Resource Server and OAuth2 Client into the framework. Today, it is quite convenient to develop applications that are secured by OAuth2 using the features available in OAuth2 Resource Server...

GHSA-V6C8-PWHQ-288M Nacos Spring vulnerable to Unsafe Deserialization

An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor component...

CVE-2023-39106

An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor component...

CVE-2023-39106

An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor component...

CVE-2023-39106

An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor component...

Design/Logic Flaw

An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor component...

OSV-2023-716 Security exception in org.springframework.expression.spel.ast.OpPlus.getValueInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61603 Crash type: Security exception Crash state: org.springframework.expression.spel.ast.OpPlus.getValueInternal org.springframework.core.convert.support.GenericConversionService$ConverterCache...

CVE-2023-39106

An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor component...

Mini-Tmall SQL注入漏洞

Mini-Tmall is a Spring Boot-based mini-Tmall mall, fast deployment runtime, suitable for use as a Bijou template. Mini-Tmall suffers from a SQL injection vulnerability, which stems from the fact that incorrect manipulation of the parameter orderBy can lead to sql injection...

CVE-2023-39106

CVE-2023-39106 concerns the Nacos Spring Project (v1.1.1 and earlier). The issue arises in the SnakeYamls Constructor(), used to parse YAML files, allowing a remote attacker to execute arbitrary code. The vulnerability is described consistently across multiple sources in the provided documents (N...

Nacos Spring Project 代码问题漏洞

Nacos Spring Project is a Nacos Group open source project for discovering, configuring and managing cloud-native applications. A security vulnerability exists in Nacos Spring Project v.1.1.1 and earlier versions, which stems from a vulnerability that allows an attacker to execute arbitrary code v...

Security Bulletin: Mutiple Vulnerabilties Affecting IBM Watson Machine Learning Accelerator

Summary IBM Watson Machine Learning Accelerator 1.2.x is vulnerable to several vulnerabilities coming from dependent compoents. These are addressed. Vulnerability Details CVEID:CVE-2023-20863 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input...

springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern

A flaw was found in Spring Framework. In this vulnerability, a security bypass is possible due to the behavior of the wildcard pattern...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.13 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

springframework: Spring Expression DoS Vulnerability

A flaw found was found in Spring Framework. This flaw allows a malicious user to use a specially crafted SpEL expression that causes a denial of service DoS...

This Week in Spring - August 15th, 2023

SpringOne, the first in-person SpringOne since the pandemic! - is next week!! I'm so excited I could spit. And I did spit. And then, I asked ChatGPT for some help writing a poem, and it did not disappoint! T'was a week before SpringOne, in Las Vegas so grand, Where devs from all corners would soo...

CVE-2023-20873

A flaw was found in Spring Boot. This targets specifically 'spring-boot-actuator-autoconfigure' package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are...

A Bootiful Podcast: Spring Cloud cofounder and lead Spencer Gibb on Spring Cloud Gateway for the Servlet API in the era of Project Loom

Hi, Spring fans! In this installment, my first since I returned from two blistering hot but super fun months in Asia, I talk to Spring Cloud cofounder and lead Spencer Gibb @SpencerBGibb about the new Servlet-friendly Spring Cloud Gateway project...

SUSE: Security Advisory (SUSE-SU-2023:3232-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...