spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5836096055672832 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5107868882042880 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.Operator.toStringAST

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5413501158162432 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.standard.InternalSpelExpressionParser.eatExp

Detailed Report: https://oss-fuzz.com/testcase?key=4824703051366400 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

spring-data-mongodb:ParameterBindingJsonReaderFuzzer: Security exception in org.springframework.expression.spel.ast.OpMinus.toStringAST

Project: https://github.com/spring-projects/spring-data-mongodb.git Detailed Report: https://oss-fuzz.com/testcase?key=5849166534541312 Project: spring-data-mongodb Fuzzing Engine: libFuzzer Fuzz Target: ParameterBindingJsonReaderFuzzer Job Type: libfuzzerasanspring-data-mongodb Platform Id: linu...

This Week in Spring - October 18th, 2022

Hi, Spring fans! Howre you doin? Im doin alright! Last week I was in Antwerp, Belgium, for the amazing Devoxx BE show. I did a presentation with my friend and hero James Ward on Spring and Kotlin that was voted third most-liked talk at a show with more than 250 speakers! That was a personal caree...

Spring at JavaOne 2022

Hi, Spring fans! Its Sunday the 16th of October as I write this and Im winging my way to sunny Las Vegas, Nevada, where Ill be attending and presenting at the first JavaOne show in years! It didnt exist as the JavaOne we know and love for years, even before the pandemic interrupted life as we kno...

spring-data-redis:GenericJackson2JsonRedisSerializerFuzzer: Security exception in com.fasterxml.jackson.databind.type.TypeParser.parseType

Project: https://github.com/spring-projects/spring-data-redis.git Detailed Report: https://oss-fuzz.com/testcase?key=4918344772091904 Project: spring-data-redis Fuzzing Engine: libFuzzer Fuzz Target: GenericJackson2JsonRedisSerializerFuzzer Job Type: libfuzzerasanspring-data-redis Platform Id:...

spring-data-redis:GenericJackson2JsonRedisSerializerFuzzer: Security exception in jaz.Zer.<clinit>

Detailed Report: https://oss-fuzz.com/testcase?key=5664501471248384 Project: spring-data-redis Fuzzing Engine: libFuzzer Fuzz Target: GenericJackson2JsonRedisSerializerFuzzer Job Type: libfuzzerasanspring-data-redis Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Information Disclosure

spring-data-rest-webmvc is vulnerable to information disclosure. The vulnerability exists due to the improper implementation of the JSON patch in the library, allowing an attacker to get information about the hidden entity attributes through maliciously crafted HTTP requests...

GHSA-FV7X-V67W-CVQV Spring Data REST can expose hidden entity attributes

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

Spring Data REST can expose hidden entity attributes

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.6, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

app.commerce-io:spring-boot-starter-data-search-jpa (1.3.0), be.personify.iam:personify-api (>=1.3.2.release, <=1.4.4.release) +37 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.6.0, <=3.6.6)

org.springframework.data:spring-data-rest-core MAVEN version =3.6.0, =1.3.2.release, =1.3.1.release, =1.3.1.release, =1.2.6.release, =1.2.7, =1.2.7, =1.2.7, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.2 and more Source cves: CVE-2022-31679 Source advisory: GHSA-FV7X-V67W-CVQV...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: OSV:GHSA-FV7X-V67W-CVQV...

com.github.paulcwarren:content-rest-spring-boot-starter (>=2.4.0, <=2.5.0), com.github.paulcwarren:spring-content-rest (>=2.4.0, <=2.5.0) +30 more potentially affected by CVE-2022-31679 via org.springframework.data:spring-data-rest-core (>=3.7.0, <=3.7.2)

org.springframework.data:spring-data-rest-core MAVEN version =3.7.0, =2.4.0, =2.4.0, =2.4.0, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =3.0.3, =1.1.4.release, =3.0.0, =3.0.4 and more Source cves: CVE-2022-31679 Source advisory: GHSA-FV7X-V67W-CVQV...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

Code injection

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

CVE-2022-31679

CVE-2022-31679 affects VMware Spring Data REST. The issue allows an attacker who knows the domain model to craft HTTP PATCH requests that expose hidden entity attributes. Affected versions include Spring Data REST 3.5.5 and older, 3.6.0–3.6.6, and 3.7.0–3.7.2. The central root cause is improper h...

CVE-2022-31679

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...