ROOT-APP-MAVEN-CVE-2018-1272 CVE-2018-1272 in org.springframework:spring-core - Patched by Root

Root has patched CVE-2018-1272 in the org.springframework:spring-core package for Root:Maven. Multiple fixed versions available...

K29042031: Multiple Spring Framework vulnerabilities

Security Advisory Description On April 5th, 2018, three new vulnerabilities were published in the popular Java web framework called Spring. Details on these vulnerabilities and exploit code are not yet available, and mitigation details may change if and when the exploit code is available. You can...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +20 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (2.0-m2)

org.springframework:spring-core MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0 - org.acegisecurity:acegi-security-adapters...

net.sourceforge.openutils:openutils-bshd5 (0.3), net.sourceforge.openutils:openutils-spring (0.2) +1 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (2.0-m5)

org.springframework:spring-core MAVEN version 2.0-m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - net.sourceforge.openutils:openutils-bshd5 0.3 - net.sourceforge.openutils:openutils-spring 0.2 -...

be.eliwan:ew-profiling-api (>=1.0, <=1.4), be.eliwan:ew-profiling-core (>=1.0, <=1.4) +1356 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.0.5.release)

org.springframework:spring-core MAVEN version 3.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - be.eliwan:ew-profiling-api =1.0, =1.0, =2.0-beta1, =1.1.1, =1.0.2, =1.1.2, =1.2, =1.0.0,...

de.codecentric:jmeter-graph-maven-plugin (0.1.0), net.sourceforge.openutils:openutils-bshd5 (>=2.0.3, <=2.0.4) +62 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (2.5.3)

org.springframework:spring-core MAVEN version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - de.codecentric:jmeter-graph-maven-plugin 0.1.0 - net.sourceforge.openutils:openutils-bshd5 =2.0.3...

ca.grimoire:mainspring (>=1.0, <=1.0.4), ch.abertschi.arquillian:arquillian-extension-aspectj (>=0.0.1-alpha1, <=0.0.1-alpha5) +1386 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (2.5.6)

org.springframework:spring-core MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ca.grimoire:mainspring =1.0, =0.0.1-alpha1, =2.1.0, =1.2.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =1.0....

org.jasig.service:person-directory (1.0.1), org.jasig:person-directory (1.0.0) +26 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (2.0.3)

org.springframework:spring-core MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.jasig.service:person-directory 1.0.1 - org.jasig:person-directory 1.0.0 -...

ch.inftec.ju:ju-dbutil-test-legacy (4.1), ch.ralscha:extdirectspring (>=1.3.0, <=1.3.1) +194 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.2.1.release)

org.springframework:spring-core MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ch.inftec.ju:ju-dbutil-test-legacy 4.1 - ch.ralscha:extdirectspring =1.3.0, =0.4.1, =0.1....

com.free-now.apis:phrase-java-client (>=1.0.8, <=3.0.0), com.free-now.maven.plugins:phrase-plugin (>=2.0.0, <=2.1.0) +90 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.2.15.release)

org.springframework:spring-core MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.free-now.apis:phrase-java-client =1.0.8, =2.0.0, =2.0.1, =2.0.1, =3.1.0, =1.0.0,...

ai.mattmann.mnemosyne:cas-cli (>=1.11.0, <=1.13.8), ai.mattmann.mnemosyne:cas-crawler (>=1.11.0, <=1.13.8) +151 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (2.5.4)

org.springframework:spring-core MAVEN version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ai.mattmann.mnemosyne:cas-cli =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0,...

com.github.inspektr:inspektr-support-spring (1.0.0.ga), com.googlecode.ehcache-spring-annotations:ehcache-spring-annotations (>=0.0.2, <=1.1.0-rc1) +63 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.0.1.release)

org.springframework:spring-core MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.github.inspektr:inspektr-support-spring 1.0.0.ga -...

org.springframework:spring-aop (1.2.3), org.springframework:spring-beans (1.2.3) +10 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (1.2.3)

org.springframework:spring-core MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.3 - org.springframework:spring-beans 1.2.3 -...

com.geodevv.testing:irmina (>=1.0.0, <=1.0.2), com.github.dblock.waffle:waffle-spring-security3 (1.7.3) +128 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.2.12.release)

org.springframework:spring-core MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.geodevv.testing:irmina =1.0.0, =2.1, =2.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.2.0 ...

ar.com.jmfsg:api-doc (>=0.0.28, <=0.0.34), ch.ralscha:extdirectspring (>=1.3.2, <=1.3.5) +268 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.2.2.release)

org.springframework:spring-core MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ar.com.jmfsg:api-doc =0.0.28, =1.3.2, =1.0.0, =1.6.0, =2.0.2, =2.0.2, =2.0.2, =2.0.2,...

ar.com.jmfsg:api-doc (>=0.0.20, <=0.0.27), ch.ralscha:extdirectspring (>=1.0.14, <=1.1.3) +712 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.0.7.release)

org.springframework:spring-core MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ar.com.jmfsg:api-doc =0.0.20, =1.0.14, =1.0, =3.0.10, =3.0.10, =3.0.10, =1.1.3,...

am.ik.blog:blog-mapper (4.6.0), am.ik.github:reactive-github-client (>=0.0.1, <=0.0.4) +1362 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (>=5.0.0.release, <=5.0.4.release)

org.springframework:spring-core MAVEN version =5.0.0.release, =0.0.1, =0.0.2, =0.1.0, =1.0.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =2.0.0, =0.2.0, =2.2.0 and more Source cves: CVE-2018-1272 Source advisory: GHSA-4487-X383-QPPH...

com.54chen:paoding-rose (1.0), com.54chen:paoding-rose-portal (1.0) +84 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (2.5.6.sec02)

org.springframework:spring-core MAVEN version 2.5.6.sec02 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.54chen:paoding-rose 1.0 - com.54chen:paoding-rose-portal 1.0 -...

at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), ca.grimoire.spring:spring-request-aware (1.0) +254 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.0.4.release)

org.springframework:spring-core MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - at.molindo:molindo-notify =1.0.0-alpha-1, =1.0.2, =1.1.1, =1.0.3, =1.0.1, =1.0-beta-1,...

br.com.uol.reconf:reconf-spring (>=1.0.4, <=1.4.0), co.jirm:jirm-spring (>=0.0.1, <=0.0.8) +415 more potentially affected by CVE-2018-1272 via org.springframework:spring-core (3.1.0.release)

org.springframework:spring-core MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - br.com.uol.reconf:reconf-spring =1.0.4, =0.0.1, =1.1, =1.2, =1.1, =0.9.0, =0.9.0, =1.0,...