A Bootiful Podcast: Couchbase and Cloud legend Laurent Doguin

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to his friend, fellow Java Champion, and director of developer relations and strategy at Couchbase, Laurent Doguin @ldoguin SpringOne 2022 is almost here! This is our first in-person event since the pandemic and its when we release...

This Week in Spring - September 20th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring wherein I endeavor as best as I can to capture the latest-and-greatest in the wide, wacky, and wonderful world of Springdom! Naturally, I fail miserably basically every week. Theres no way I could hope to capture everything of...

Security Bulletin: Rational Test Control Panel component in Rational Test Virtualization Server and Rational Test Workbench is vulnerable to a denial of service attack in Spring Framework (CVE-2022-22971)

Summary Spring Framework is vulnerable to a security issue affecting Rational Test Control Panel Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending a...

Security Bulletin: IBM Sterling Control Center is vulnerable to denial of service by authenticated user due to Spring Framework (CVE-2022-22971)

Summary Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition. IBM Sterling Control Center uses...

Security Bulletin: IBM Sterling Control Center is vulnerable to denial of servicedue to Spring Framework (CVE-2022-22970)

Summary Spring Framework is vulnerable to a denial of service, caused by a flaw in the handling of file uploads. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition. IBM Sterling Control Center uses Spring...

springframework: malicious input leads to insertion of additional log entries

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries...

spring-framework:AspectJExpressionPointcutFuzzer: Security exception in org.aspectj.weaver.patterns.PatternParser.parseAtomicPointcut

Project: https://github.com/spring-projects/spring-framework.git Detailed Report: https://oss-fuzz.com/testcase?key=6350062699020288 Project: spring-framework Fuzzing Engine: libFuzzer Fuzz Target: AspectJExpressionPointcutFuzzer Job Type: libfuzzerasanspring-framework Platform Id: linux Crash...

spring-framework:AspectJExpressionPointcutFuzzer: Security exception in org.aspectj.weaver.patterns.PatternParser.parseNotOrPointcut

Project: https://github.com/spring-projects/spring-framework.git Detailed Report: https://oss-fuzz.com/testcase?key=5209576781250560 Project: spring-framework Fuzzing Engine: libFuzzer Fuzz Target: AspectJExpressionPointcutFuzzer Job Type: libfuzzerasanspring-framework Platform Id: linux Crash...

spring-framework:AspectJExpressionPointcutFuzzer: Security exception in org.aspectj.weaver.patterns.PatternParser.parseNotOrTypePattern

Project: https://github.com/spring-projects/spring-framework.git Detailed Report: https://oss-fuzz.com/testcase?key=5157996564447232 Project: spring-framework Fuzzing Engine: libFuzzer Fuzz Target: AspectJExpressionPointcutFuzzer Job Type: libfuzzerasanspring-framework Platform Id: linux Crash...

spring-framework:AspectJExpressionPointcutFuzzer: Security exception in org.aspectj.weaver.tools.PointcutParser.validateAgainstSupportedPrimitives

Project: https://github.com/spring-projects/spring-framework.git Detailed Report: https://oss-fuzz.com/testcase?key=6144883185811456 Project: spring-framework Fuzzing Engine: libFuzzer Fuzz Target: AspectJExpressionPointcutFuzzer Job Type: libfuzzerasanspring-framework Platform Id: linux Crash...

spring-framework:TransactionAttributeSourceEditorFuzzer: Security exception in org.springframework.util.ClassUtils.forName

Project: https://github.com/spring-projects/spring-framework.git Detailed Report: https://oss-fuzz.com/testcase?key=4664764709601280 Project: spring-framework Fuzzing Engine: libFuzzer Fuzz Target: TransactionAttributeSourceEditorFuzzer Job Type: libfuzzerasanspring-framework Platform Id: linux...

spring-framework:TransactionAttributeSourceEditorFuzzer: Security exception in org.springframework.util.PatternMatchUtils.simpleMatch

Project: https://github.com/spring-projects/spring-framework.git Detailed Report: https://oss-fuzz.com/testcase?key=6415299158605824 Project: spring-framework Fuzzing Engine: libFuzzer Fuzz Target: TransactionAttributeSourceEditorFuzzer Job Type: libfuzzerasanspring-framework Platform Id: linux...

spring-framework:TransactionAttributeSourceEditorFuzzer: Security exception in org.springframework.util.PatternMatchUtils.simpleMatch

Project: https://github.com/spring-projects/spring-framework.git Detailed Report: https://oss-fuzz.com/testcase?key=6599219590332416 Project: spring-framework Fuzzing Engine: libFuzzer Fuzz Target: TransactionAttributeSourceEditorFuzzer Job Type: libfuzzerasanspring-framework Platform Id: linux...

Spring Framework Code Execution

The vulnerability of the Spring Framework software platform is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using a specially created .jar file...

Security Bulletin: IBM QRadar SIEM includes components with multiple known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed the relevant vulnerabilities. Vulnerability Details CVEID:CVE-2021-43859 DESCRIPTION: XStream is vulnerable to a denial of service, caused by...

This Week in Spring - August 23rd, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Weve got a ton to cover, so lets dive right into it! A Bootiful Podcast: Flowable founder Joram Barrez on a Bootiful Podcast on workflow, business process management, and more Building IoT Applications Using Fauna and Spring...

Spring Web Flow 3.0 M1 Released

It has been almost 4 years since the last set of Spring Web Flow releases. Nevertheless, the project continues to serve a specific need particularly well, arguably better than alternatives, and remains in active use. While there hasnt been a strong driver for new releases, the upcoming Spring...

This Week in Spring - August 9th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you this fine Tuesday? Im in Kansas City for the Kansas City Developer Conference. Its a crazy fun show, and Im glad to be here. I only wish the rest of you were here, too! Weve got a packed This Week in Spring,...

Security Bulletin: Vulnerabilities in Spring Framework affect IBM Cloud Pak System (CVE-2022-22965, CVE-2020-5421)

Summary IBM Cloud Pak System is affected by a remote code execution in Spring Framework CVE-2022-22965 and CVE-2020-5421. IBM Cloud Pak System ships with AWS component that includes it but is not used by it. The fix removes Spring from the product. This security bulletin service applies to IBM...

spring-expression: Denial of service via specially crafted SpEL expression

A flaw was found in the Spring Framework. This flaw allows an attacker to craft a special Spring Expression, causing a denial of service...