Security Bulletin: IBM Sterling B2B Integrator is vulnerable to denial of service due to Spring Framework (CVE-2022-22970)

Summary IBM Sterling B2B Integrator has addressed the denial of service security vulnerability in Spring Framework shipped with the product. Vulnerability Details CVEID:CVE-2022-22970 DESCRIPTION: Vmware Tanzu Spring Framework is vulnerable to a denial of service, caused by a flaw in the handling...

A Bootiful Podcast: opensource, Spring Cloud, and Kubernetes maestro Abel Salgado Romero

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Abel Salgado Romero @abelsromero about open source, Kubernetes, and building Kubernetes controllers with Spring Boot and GraalVM native images...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell CVE-2021-44228: Brief Description Apache L...

TIBCO JasperReports Server 6.x < 6.2.5 / 6.3.0 / 6.3.2 / 6.3.3 / 6.4.0 / 6.4.2 Information Disclosure (CVE-2018-5430)

According to its self-reported version, the instance of TIBCO JasperReports Server running on the remote web server is 6.x 6.2.5, 6.3.0, 6.3.2, 6.3.3, 6.4.0, or 6.4.2. It is, therefore, affected by an information disclosure vulnerability in the Spring web flows component that can allow any...

Exploit for Expression Language Injection in Vmware Spring_Cloud_Gateway

Introduction Through CVE-2022-22947, an attack is attempte...

This Week in Spring - February 7th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's Tuesday, February 7th, 2023, as I write this and I'm so very glad to be talking to you. How're you doin'? Some housekeeping: I'll be doing more live streams over on my YT channel - join me and we'll talk shop. I'm going...

Spring Security 5.6.x < 5.6.9 / 5.7.x < 5.7.5 Authorization Bypass

The remote host contains a Spring Security version that is 5.7.x prior to 5.7.5 or 5.6.x prior to 5.6.9. It may, therefore, be affected by an authorization bypass vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Moderate: Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.2.SP1 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Security Bulletin: Vulnerabilities have been identified in Spring Framework, OpenSSL and Apache HTTP Server shipped with the DS8000 Hardware Management Console (HMC)

Summary The updates indicated below have been released to address the following vulnerabilities: Spring Framework CVE-2022-22965, OpenSSL vulnerabilities CVE-2022-0778, Apache HTTP Server CVE-2021-26691, CVE-2021-40438, CVE-2021-44790, and CVE-2021-20325. Vulnerability Details CVEID:CVE-2022-0778...

Jira Server/DC impacted by CVE-2022-22970 & CVE-2022-22971 via vulnerable version of Spring framework

Jira is not impacted no action is required as the vulnerability +cannot be exploited+. All Jira versions below 9.6 uses an affected version of Spring Framework, reason why the JRASERVER-74776 was published, however Jira +does not use the affected methods from the Spring+, hence +is not impacted+:...

The 2022 State of Spring Survey Report

Hi, Spring fans! You're awesome! I know you're awesome. You know you're awesome. And the Spring team works for you. We like working for you because you dream awesome dreams and build awesome things. And we can't work effectively with and for you if we don't know where everyone stands. Every year ...

An ever green, ever great way to learn Spring

I could do this post every week. Wait, I do do this post every week! It's called This Week in Spring, and in it I recap a lot of interesting new bits of content on the internet that elaborate or introduce or innovate. I love those points of data. They help. But they're almost never a full-guided...

Security Bulletin: Vulnerability in Spring Framework affects IBM Process Mining and could allow a local attacker to execute arbitrary code on the system (CVE-2022-22965)

Summary There is a vulnerability in Spring Framework that could allow a local attacker to execute arbitrary code on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. The product is in an affected but not vulnerab...

This Week in Spring - January 31st, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm not going to spend too much time here in the preamble because a today's both my birthday and my late father's birthday and b I got the worst gift ever: COVID-19. Sigh. So, I'm going back to bed. Without further ado, let's...

This Week in Spring - January 31st, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm not going to spend too much time here in the preamble because a today's both my birthday and my late father's birthday and b I got the worst gift ever: COVID-19. Sigh. So, I'm going back to bed. Without further ado, let's...

Important: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.14.5 Patch 1 release and security update

A patch is now available for Camel for Spring Boot 3.14.5. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS bas...

Security Bulletin: Vulnerabilities in Spring Framework affects IBM Common Licensing's Administration And Reporting Tool (ART) and its Agent (CVE-2022-22978, 220811)

Summary Security Vulnerablities have been addressed in IBM Common Licensing. In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. A fix is available to address the vulnerability...

Spring Cloud Azure 5.0 is now Generally Available

Were very pleased to announce that Spring Cloud Azure 5.0 is now generally available. This major release includes the following features, improvements, and documentation updates: Compatible with Spring Boot 3 and Spring Cloud 2022.0.0 Supports Passwordless Connections Updated Azure for Spring...

Spring Cloud Azure 5.0 is now Generally Available

We're very pleased to announce that Spring Cloud Azure 5.0 is now generally available. This major release includes the following features, improvements, and documentation updates: Compatible with Spring Boot 3 and Spring Cloud 2022.0.0 Supports Passwordless Connections Updated Azure for Spring...

Spring Security < 5.5.7 / 5.6.x < 5.6.4 Authorization Bypass

The remote host contains a Spring Security version that is prior to 5.5.7 or 5.6.x prior to 5.6.4. It is, therefore, affected by an authorization bypass vulnerability. - In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to ...