This Week in Spring - July 15th, 2025

Hi, Spring fans! It's already the 15th of July! We're closer to 2026 than we are to 2024. And time's sure flying. Like I will, tomorrow. I'll be flying to Denver for the amazing UBERCONF software show! I'll be doing a workshop and two talks, and if you're there, I hope you'll come say "hi"! Let's...

CVE-2019-20343

The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element within a plugin element can specify an arbitrary program in an executable element and can also specify arbitrary command-line arguments in an arguments element...

ch.acanda.maven:code-analysis-maven-plugin (>=0.1.0 <=1.6.1), com.eventoframework:evento-cli (>=ev1.4.1 <=ev1.15.5) +105 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-core (>=6.21.0 <=7.0.0)

net.sourceforge.pmd:pmd-core MAVEN version =6.21.0, =0.1.0, =ev1.4.1, =ev1.4.1, =2.17.0, =1.1.0, =1.0.2, =1.2.0, =0.18, =0.18, =0.18, =2.10.2, =2.6.1, =2.19.0 and more Source cves: CVE-2025-23215 Source advisory: OSV:GHSA-88M4-H43F-WX84...

ch.acanda.maven:code-analysis-maven-plugin (>=1.6.0 <=1.6.1), net.sourceforge.pmd:pmd-cli (>=7.0.0 <=7.1.0) +1 more potentially affected by CVE-2025-23215 via net.sourceforge.pmd:pmd-designer (=7.0.0)

net.sourceforge.pmd:pmd-designer MAVEN version =7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-designer and may be impacted: - ch.acanda.maven:code-analysis-maven-plugin =1.6.0, =7.0.0, =7.0.0, =7.1.0 Source cves:...

SUSE SLED15: jctools / jctools-channels / jctools-experimental / jctools-javadoc / etc (SUSE-SU-2024:4407-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4407-1 advisory. - CVE-2024-47535: Fixed unsafe reading of large environment files when Netty is loaded by a java...

Security update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative

This update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative fixes the following issues: CVE-2024-47535: Fixed unsafe reading of large environment files when Netty is loaded by a java application can lead to a crash due to the JVM memory limit being exceeded in netty...

dev.sigstore:sigstore-maven-plugin (>=0.4.0 <=1.1.0), hboutemy:sigstore-maven-plugin (=1.0.0-beta-3) +3 more potentially affected by CVE-2024-54140 via dev.sigstore:sigstore-java (>=0.4.0 <=1.1.0)

dev.sigstore:sigstore-java MAVEN version =0.4.0, =0.4.0, =2.0.2, =2.0.3, =2.0.4 Source cves: CVE-2024-54140 Source advisory: OSV:GHSA-JP26-88MW-89QR...

dev.sigstore:sigstore-maven-plugin (=1.0.0), org.apache.maven.resolver:maven-resolver-generator-sigstore (>=2.0.2 <=2.0.4) +1 more potentially affected by CVE-2024-53267 via dev.sigstore:sigstore-java (=1.0.0)

dev.sigstore:sigstore-java MAVEN version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.sigstore:sigstore-java and may be impacted: - dev.sigstore:sigstore-maven-plugin =1.0.0 - org.apache.maven.resolver:maven-resolver-generator-sigstore...

org.keycloak:keycloak-guides (>=19.0.0 <=19.0.3), org.keycloak:keycloak-guides-maven-plugin (>=19.0.0 <=19.0.3) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=19.0.0 <=19.0.3)

org.keycloak:keycloak-quarkus-server MAVEN version =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.0, =19.0.3 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0 <=4.0.5-25.0), org.keycloak:keycloak-guides (>=25.0.0 <=25.0.6) +4 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=25.0.0 <=25.0.6)

org.keycloak:keycloak-quarkus-server MAVEN version =25.0.0, =3.0.1-25.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.6 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

org.keycloak:keycloak-guides (>=16.0.0 <=16.1.1), org.keycloak:keycloak-guides-maven-plugin (>=16.0.0 <=16.1.1) +3 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=16.0.0 <=16.1.1)

org.keycloak:keycloak-quarkus-server MAVEN version =16.0.0, =16.0.0, =16.0.0, =16.0.0, =16.0.0, =16.0.0, =16.1.1 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

SUSE-RU-2024:3971-1 Recommended update for mojo-parent

This update for mojo-parent fixes the following issues: xalan-j2 was updated from version 2.7.2 to 2.7.3: - Security issues fixed: CVE-2022-34169: Fixed integer truncation issue when processing malicious XSLT stylesheets bsc1201684 - Changes and Bugs fixed: Java 8 is now the minimum requirement...

app.valuationcontrol:webservice (>=0.5.0 <=0.5.1), ba.sake:sharaf_3 (>=0.0.7 <=0.7.4) +974 more potentially affected by CVE-2024-3653 via io.undertow:undertow-core (>=2.3.0.Alpha1 <=2.3.14.Final)

io.undertow:undertow-core MAVEN version =2.3.0.Alpha1, =0.5.0, =0.0.7, =1.1.15, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.6, =1.0.31 and more Source cves: CVE-2024-3653 Source advisory: OSV:GHSA-CH7Q-GPFF-H9HP...

OPENSUSE-SU-2024:13471-1 jcasgen-maven-plugin-3.5.0-1.1 on GA media

These are all security issues fixed in the jcasgen-maven-plugin-3.5.0-1.1 package on the GA media of openSUSE Tumbleweed...

SBOM support in Spring Boot 3.3

Spring Boot 3.3.0 has been released, and it contains support for SBOMs. SBOM stands for "Software Bill of Materials" and describes the components used to build a software artifact. In the context of this blog post, that's your Spring Boot application. These SBOMs are useful because they describe...

com.srcclr:srcclr-maven-plugin (>=3.1.23 <=3.1.25), org.keycloak:keycloak-crypto-fips1402 (>=19.0.0 <=25.0.6) +17 more potentially affected by CVE-2024-30171 via org.bouncycastle:bctls-fips (>=1.0.12.2 <=1.0.18)

org.bouncycastle:bctls-fips MAVEN version =1.0.12.2, =3.1.23, =19.0.0, =14.7.0.0, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.5.1, =4.6.3 and more Source cves: CVE-2024-30171 Source advisory:...

Fedora: Security Advisory for clojure-maven-plugin (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for javacc-maven-plugin (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for string-template-maven-plugin (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for directory-maven-plugin (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...