CVE-2023-38493

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of t...

CVE-2023-38493 Paths contain matrix variables bypass decorators

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of t...

CVE-2023-38493 Paths contain matrix variables bypass decorators

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of t...

CVE-2023-38493

CVE-2023-38493 affects Armeria (microservice framework) when used with Spring integration. The issue arises in how matrix variables in paths are handled when Armeria decorates or forwards requests to Spring controllers via TomcatService or JettyService, potentially allowing bypass of the authoriz...

com.linecorp.armeria:armeria-grpc (0.41.0), com.linecorp.armeria:armeria-jetty (0.41.0) +8 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.41.0)

com.linecorp.armeria:armeria MAVEN version 0.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.41.0 - com.linecorp.armeria:armeria-jetty 0.41.0 -...

com.linecorp.armeria:armeria-grpc (0.63.0), com.linecorp.armeria:armeria-jetty (0.63.0) +14 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.63.0)

com.linecorp.armeria:armeria MAVEN version 0.63.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.63.0 - com.linecorp.armeria:armeria-jetty 0.63.0 -...

com.linecorp.armeria:armeria-grpc (0.74.1), com.linecorp.armeria:armeria-jetty (0.74.1) +17 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.74.1)

com.linecorp.armeria:armeria MAVEN version 0.74.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.74.1 - com.linecorp.armeria:armeria-jetty 0.74.1 -...

com.linecorp.armeria:armeria-grpc (0.75.0), com.linecorp.armeria:armeria-jetty (0.75.0) +17 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.75.0)

com.linecorp.armeria:armeria MAVEN version 0.75.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.75.0 - com.linecorp.armeria:armeria-jetty 0.75.0 -...

com.linecorp.armeria:armeria-grpc (0.77.0), com.linecorp.armeria:armeria-jetty (0.77.0) +19 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.77.0)

com.linecorp.armeria:armeria MAVEN version 0.77.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.77.0 - com.linecorp.armeria:armeria-jetty 0.77.0 -...

com.linecorp.armeria:armeria-brave (0.90.3), com.linecorp.armeria:armeria-grpc (0.90.3) +42 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.90.3)

com.linecorp.armeria:armeria MAVEN version 0.90.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-brave 0.90.3 - com.linecorp.armeria:armeria-grpc 0.90.3 -...

com.linecorp.armeria:armeria-brave (0.95.0), com.linecorp.armeria:armeria-grpc (0.95.0) +39 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.95.0)

com.linecorp.armeria:armeria MAVEN version 0.95.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-brave 0.95.0 - com.linecorp.armeria:armeria-grpc 0.95.0 -...

cn.leancloud:filter-service-core (1.13), cn.leancloud:filter-service-metrics (1.13) +38 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.98.0)

com.linecorp.armeria:armeria MAVEN version 0.98.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - cn.leancloud:filter-service-core 1.13 - cn.leancloud:filter-service-metrics 1.13 -...

com.linecorp.armeria:armeria-brave (0.98.2), com.linecorp.armeria:armeria-dropwizard (0.98.2) +36 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.98.2)

com.linecorp.armeria:armeria MAVEN version 0.98.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-brave 0.98.2 - com.linecorp.armeria:armeria-dropwizard 0.98.2 -...

com.github.delegacy.youngbot:young-bot-core (>=0.0.2, <=0.0.3), com.github.delegacy.youngbot:young-bot-dispatcher (>=0.0.2, <=0.0.3) +20 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.52.0)

com.linecorp.armeria:armeria MAVEN version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.github.delegacy.youngbot:young-bot-core =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2,...

com.linecorp.armeria:armeria-grpc (0.53.2), com.linecorp.armeria:armeria-jetty (0.53.2) +13 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.53.2)

com.linecorp.armeria:armeria MAVEN version 0.53.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.53.2 - com.linecorp.armeria:armeria-jetty 0.53.2 -...

com.linecorp.armeria:armeria-grpc (0.29.1.final), com.linecorp.armeria:armeria-jetty (0.29.1.final) +4 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.29.1.final)

com.linecorp.armeria:armeria MAVEN version 0.29.1.final is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.29.1.final - com.linecorp.armeria:armeria-jetty 0.29.1.final...

com.linecorp.armeria:armeria-grpc (0.33.0), com.linecorp.armeria:armeria-jetty (0.33.0) +6 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.33.0)

com.linecorp.armeria:armeria MAVEN version 0.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.33.0 - com.linecorp.armeria:armeria-jetty 0.33.0 -...

com.linecorp.armeria:armeria-grpc (0.34.1), com.linecorp.armeria:armeria-jetty (0.34.1) +6 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.34.1)

com.linecorp.armeria:armeria MAVEN version 0.34.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.34.1 - com.linecorp.armeria:armeria-jetty 0.34.1 -...

com.linecorp.armeria:armeria-grpc (0.38.0), com.linecorp.armeria:armeria-jetty (0.38.0) +7 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.38.0)

com.linecorp.armeria:armeria MAVEN version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.38.0 - com.linecorp.armeria:armeria-jetty 0.38.0 -...

com.linecorp.armeria:armeria-grpc (0.42.0), com.linecorp.armeria:armeria-jetty (0.42.0) +9 more potentially affected by CVE-2023-38493 via com.linecorp.armeria:armeria (0.42.0)

com.linecorp.armeria:armeria MAVEN version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.linecorp.armeria:armeria and may be impacted: - com.linecorp.armeria:armeria-grpc 0.42.0 - com.linecorp.armeria:armeria-jetty 0.42.0 -...