GHSA-QW22-8W9R-864H io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud

Summary IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Details See https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.javaL202 This...

PT-2023-25712 · Micronaut · Micronaut Security

Name of the Vulnerable Software and Affected Versions: Micronaut Security versions prior to 3.1.2 Micronaut Security versions prior to 3.2.4 Micronaut Security versions prior to 3.3.2 Micronaut Security versions prior to 3.4.3 Micronaut Security versions prior to 3.5.3 Micronaut Security versions...

GHSA-2457-2263-MM9F Memory leak in micronaut-core

Impact Sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. Patches The problem is patched in Micronaut 3.2.7 and above. Workarounds The default content type binder can be replaced in an existing Micronau...

Memory leak in micronaut-core

Impact Sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. Patches The problem is patched in Micronaut 3.2.7 and above. Workarounds The default content type binder can be replaced in an existing Micronau...

Denial Of Service (DoS)

io.micronaut, micronaut-core is vulnerable to denial of service. The vulnerability exists in ConversionContext.java due to the use of ConversionContext constants leading to a memory leak causing an application crash...

Object Computing micronaut resource management error vulnerability

Object Computing micronaut is a JVM-based full-stack framework from US-based Object Computing, which is primarily used to build modular microservices and serverless applications.A resource management error vulnerability exists in Object Computing Micronaut, which stems from the fact that in the...

CVE-2022-21700

Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously us...

Memory corruption

Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously us...

CVE-2022-21700 Memory leak in micronaut-core

Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously us...

CVE-2022-21700 Memory leak in micronaut-core

Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously us...

CVE-2022-21700

CVE-2022-21700 affects Micronaut core. The issue arises when an invalid Content-Type header is processed, causing a memory leak in DefaultArgumentConversionContext due to static state usage. Impact described as memory leak with potential degradation of availability. Patches exist in Micronaut 3.2...

CVE-2022-21700 Memory leak in micronaut-core

Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously us...

Object Computing micronaut 资源管理错误漏洞

Object Computing micronaut is a JVM-based full-stack framework from US-based Object Computing, which is primarily used to build modular microservices and serverless applications.A resource management error vulnerability exists in Object Computing Micronaut, which stems from the fact that in the...

GHSA-CJX7-399X-P2RJ Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core

With a basic configuration like yaml router: static-resources: assets: enabled: true mapping: /.assets/public/ paths: file:/home/lstrmiska/test/ it is possible to access any file from a filesystem, using "/../../" in URL, as Micronaut does not restrict file access to configured paths. Repro Steps...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core

With a basic configuration like yaml router: static-resources: assets: enabled: true mapping: /.assets/public/ paths: file:/home/lstrmiska/test/ it is possible to access any file from a filesystem, using "/../../" in URL, as Micronaut does not restrict file access to configured paths. Repro Steps...

CVE-2021-32769

Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut...

CVE-2021-32769

Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut...

CVE-2021-32769

Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut...

Path traversal

Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut...

CVE-2021-32769 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core

Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut...