club.zhcs:axe-sigar (>=1.5.14, <=1.5.14.1), club.zhcs:distributed-job-admin (1.0) +365 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.14.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - club.zhcs:axe-sigar =1.5.14, =2.19.10.0, =2.19.10.0,...

com.github.robertnetz:dogstatsd-spring-boot-starter (1.2), com.ixortalk:ixortalk-image-service (>=0.0.1, <=0.0.8) +90 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.18.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.robertnetz:dogstatsd-spring-boot-starter 1.2 -...

com.github.timpeeters:spring-boot-actuator-server-config (1.0.4), com.ixortalk:ixortalk-aws-s3-library (>=1.1.0, <=1.2.0) +36 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.19.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - com.github.timpeeters:spring-boot-actuator-server-config 1.0...

ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.2.0), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +7126 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (>=2.0.0.release, <=2.7.17)

org.springframework.boot:spring-boot-actuator MAVEN version =2.0.0.release, =0.1.2, =0.5.0, =0.5.21, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2023-34055 Source advisory:...

CVE-2023-34055

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring M...

CVE-2023-34053

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC or Spring WebFlux...

Design/Logic Flaw

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring M...

UBUNTU-CVE-2023-34053

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC or Spring WebFlux...

Design/Logic Flaw

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC or Spring WebFlux...

CVE-2023-34055 Spring Boot server Web Observations DoS Vulnerability

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring M...

CVE-2023-34055 Spring Boot server Web Observations DoS Vulnerability

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring M...

am.ik.access-logger:access-logger (>=0.1.0, <=0.1.5), cc.vihackerframework:vihacker-auth-starter (1.0.8.r) +979 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (>=3.0.0, <=3.0.12)

org.springframework.boot:spring-boot-actuator MAVEN version =3.0.0, =0.1.0, =1.0.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2023-34055 Source advisory: MEND:CVE-2023-34055...

CVE-2023-34055

CVE-2023-34055 concerns denial-of-service in Spring Boot when using Spring MVC/WebFlux and the actuator JAR on the classpath. Affected are Spring Boot versions 2.7.0–2.7.17, 3.0.0–3.0.12, and 3.1.0–3.1.5. The DoS condition arises from specially crafted HTTP requests; exploitation requires the aff...

CVE-2023-34055

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring M...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-fragmentisers (>=1.1.0, <=3.4.0) +1437 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (>=3.1.0, <=3.1.5)

org.springframework.boot:spring-boot-actuator MAVEN version =3.1.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =2.10.0, =1.1.0, =1.1.0, =2.3.0, =1.1.0, =1.1.0, =1.1.0, =2.3.0, =3.6.0, =3.6.1 - be.vlaanderen.informatievlaanderen...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12), ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7) +8384 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (>=1.0.0.release, <=2.7.17)

org.springframework.boot:spring-boot-actuator MAVEN version =1.0.0.release, =0.1.8, =0.1.6, =0.1.2, =0.5.0, =0.5.21, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2023-34055 Source advisory: MEND:CVE-2023-34055...

CVE-2023-34053 Spring Framework server Web Observations DoS Vulnerability

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC or Spring WebFlux...

CVE-2023-34053

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC or Spring WebFlux...

CVE-2023-34055: Undefined Security Weakness

In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring M...

This Week in Spring - 28 November, 2023

Hi, Spring fans! I hope everyone who celebrated Thanksgiving had a wonderful time. Did you indulge in too much turkey? Anyway, let's jump into this week's edition of This Week in Spring—a particularly special one for a couple of reasons. First, it's our first issue after the launch of Spring Boot...