This Week in Spring - November 12th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! Spring Cloud 2024.0.0-RC1 aka Moorgate has been released In this installment of A Bootiful Podcast , I talk to Gradle developer advocate Baruch Sadogursky good news everybody! GraalVM will now support jcmd, which allows you t...

From Spring Framework 6.2 to 7.0

Dear Spring community, Spring Framework 6.2 is shaping up for general availability in November 2024, with particularly significant revisions in the core container and in our web support: see "What's New in Spring Framework 6.2". This release is designed for use with JDK 17-23 and Jakarta EE 9-10...

CVAD wizard fails with device name # is invalid when PVS-Accelerator is enabled

We are using XenServer 8.0 and PVS Accelerator the CVAD wizard will fail to create new devices. When an AOT trace is captured and analyzed you will see the following errors in the logs: PVSDllHypervisorPlatformsAO,,0,,5,Information,"XenAPI failure, error description:...

Spring Tips: Further, Faster with Spring Boot 3.3

Hi, Spring fans! In this installment we look at ways to make your applications go further, faster, with AppCDS, GraalVM, AOT on the JRE, and Project CRaC coordinate restore at checkpoint springboot java graalvm programming coding...

This Year in Spring - 2023

Welcome to another installment of This Week in Spring! It's December 26th, 2023, and we're staring down the new year! And you know what that means, right? It's time for our annual roundup, looking at all the latest and greatest in the wild and wonderful world of Springdom. This is This Year in...

PT-2023-35566

Name of the Vulnerable Software and Affected Versions WasmEdge affected versions not specified Description The issue is related to a crash in the WasmEdge compiler. Specifically, it occurs in the FunctionCompiler::compileReturn function, which is part of the WasmEdge::AOT::Compiler module. The...

wasmedge:wasmedge-fuzztool: Segv on unknown address in FunctionCompiler::compileReturn

Project: https://github.com/WasmEdge/WasmEdge.git Detailed Report: https://oss-fuzz.com/testcase?key=5854073959874560 Project: wasmedge Fuzzing Engine: afl Fuzz Target: wasmedge-fuzztool Job Type: aflasanwasmedge Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...

io.micronaut.security:micronaut-security-aot (3.4.2) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.4.2)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.4.2 Source cves:...

io.micronaut.security:micronaut-security-aot (>=3.10.0, <=3.10.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.10.0, <=3.10.1)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.10.0, =3.10.0, =3.10.1 Source cves: CVE-2023-36820 Source advisory: MEND:CVE-2023-36820...

io.micronaut.security:micronaut-security-aot (3.11.0) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.11.0)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.11.0 Source cves:...

io.micronaut.security:micronaut-security-aot (>=3.9.0, <=3.9.5) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.9.0, <=3.9.5)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.9.0, =3.9.0, =3.9.5 Source cves: CVE-2023-36820 Source advisory: MEND:CVE-2023-36820...

io.micronaut.security:micronaut-security-aot (>=3.10.0, <=3.10.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.10.0, <=3.10.1)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.10.0, =3.10.0, =3.10.1 Source cves: CVE-2023-36820 Source advisory: OSV:GHSA-QW22-8W9R-864H...

io.micronaut.security:micronaut-security-aot (>=3.10.0, <=3.10.1) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.10.0, <=3.10.1)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.10.0, =3.10.0, =3.10.1 Source cves: CVE-2023-36820 Source advisory: GHSA-QW22-8W9R-864H...

io.micronaut.security:micronaut-security-aot (3.4.2) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.4.2)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.4.2 Source cves:...

io.micronaut.security:micronaut-security-aot (3.11.0) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.11.0)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.11.0 Source cves:...

io.micronaut.security:micronaut-security-aot (3.11.0) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.11.0)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.11.0 Source cves:...

io.micronaut.security:micronaut-security-aot (>=3.9.0, <=3.9.5) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.9.0, <=3.9.5)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.9.0, =3.9.0, =3.9.5 Source cves: CVE-2023-36820 Source advisory: GHSA-QW22-8W9R-864H...

io.micronaut.security:micronaut-security-aot (3.4.2) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (3.4.2)

io.micronaut.security:micronaut-security-oauth2 MAVEN version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut.security:micronaut-security-oauth2 and may be impacted: - io.micronaut.security:micronaut-security-aot 3.4.2 Source cves:...

io.micronaut.security:micronaut-security-aot (>=3.9.0, <=3.9.5) potentially affected by CVE-2023-36820 via io.micronaut.security:micronaut-security-oauth2 (>=3.9.0, <=3.9.5)

io.micronaut.security:micronaut-security-oauth2 MAVEN version =3.9.0, =3.9.0, =3.9.5 Source cves: CVE-2023-36820 Source advisory: OSV:GHSA-QW22-8W9R-864H...

OSV-2023-857 Segv on unknown address in FunctionCompiler::compileReturn

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62375 Crash type: Segv on unknown address Crash state: FunctionCompiler::compileReturn WasmEdge::AOT::Compiler::compile WasmEdge::AOT::Compiler::compile...