PT-2018-11252

Name of the Vulnerable Software and Affected Versions Spring Cloud SSO Connector version 2.1.2 Description The issue is related to a regression in the Spring Cloud SSO Connector that disables issuer validation in resource servers not bound to the SSO service. This allows a remote attacker to...

CVE-2018-1256: Undefined Security Weakness

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

Issuer validation regression in Spring Cloud SSO Connector

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1), com.github.springcloud:moss-client-1.x (1.0.1.release) +162 more potentially affected by CVE-2018-1000130 via org.jolokia:jolokia-core (>=1.3.7, <=1.4.0)

org.jolokia:jolokia-core MAVEN version =1.3.7, =0.0.1, =1.2.0, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =1.5.4, =v0.3.3, =v0.3.3, =2.0-beta-1, =2.3.0, =2.7.1 and more Source cves: CVE-2018-1000130 Source advisory: MEND:CVE-2018-1000130...

Unverifiable Symmetric Encryption

spring-cloud-config has a flaw which allows malicious manipulation of symmetric encryptions. The vulnerability exists because its default symmetric encryption does not use a Message Authentication Code MAC to verify the authenticity of encrypted message...