Important: Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release

Camel for Spring Boot 3.18.3 Patch 2 release and security update is now available. Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

spring-boot: Spring Boot Welcome Page DoS Vulnerability

A flaw was found in Spring Boot, occurring prominently in Spring MVC with a reverse proxy cache. This issue requires Spring MVC to have auto-configuration enabled and the application to use Spring Boot's welcome page support, either static or templated, resulting in the application being deployed...

This Week in Spring - June 13th, 2023

This Month in Spring - June 13th, 2023 Hi, Spring fans! Welcome to another installment of This Week in Spring! I am in beautiful Taipei, eating delicious food and meeting amazing people in the sweltering weather. How're you doin'? I've got to join a meeting, so I'll make this quick. One quick thi...

K000134945: Spring Boot vulnerability CVE-2022-46166

Security Advisory Description Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers e.g. Teams-Notifier and write access to environment variables via UI are affected. User...

Securing Spring Boot Applications With SSL

Secure Sockets Layer SSL and Transport Layer Security TLS are key components of securing communications between systems in a layered or service-oriented architecture. Spring Boot applications in such an architecture often accept incoming network connections or create outgoing connections, and...

A Bootiful Podcast: Spring Boot team member Moritz Halbritter (@m_halbritter)

Hi, Spring fans! In this installment Josh Long YouTube.com/@coffeesoftware.com talks to Spring Boot team member Moritz Halbritter @mhalbritter...

Denial Of Service (DoS)

spring-boot-autoconfigure is vulnerable to Denial Of Service DoS. The vulnerability is applicable when the application has Spring MVC auto-configuration enabled and uses the Spring Boot welcome page, which can be either static or templated, and the application is deployed behind a proxy which...

IceCMS Access Control Error Vulnerability

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . An access control error vulnerability exists in IceCMS v1.0.0, which stems from improper access control in the system and can be exploited by an attacker to cause sensitive information leakage...

IceCMS Cross-Site Scripting Vulnerability

IceCMS is a content management system based on Spring Boot + Vue front-end and back-end separation . IceCMS v1.0.0 version exists cross-site scripting vulnerability, the vulnerability stems from the application of the user-supplied data lack of effective filtering and escaping, an attacker can...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-application (>=1.0.0, <=1.2.0) +24518 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.0.0.release, <=2.5.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.0, =4.4.0.1 and more Source cves: CVE-2023-20883 Source advisory: GHSA-XF96-W227-R7C4...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.djl.spring:djl-spring-boot-starter-autoconfigure (0.15) +7491 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.6.0, <=2.6.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.1 - ai.ylyue:yue-library-data-mybatis j11.2.6.2 and more Source cves: CVE-2023-20883 Source advisory: OSV:GHSA-XF96-W227-R7C4...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.djl.spring:djl-spring-boot-starter-autoconfigure (0.15) +7491 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.6.0, <=2.6.14)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.6.0, =4.4.0.2, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.0, =j11.2.6.1 - ai.ylyue:yue-library-data-mybatis j11.2.6.2 and more Source cves: CVE-2023-20883 Source advisory: GHSA-XF96-W227-R7C4...

ai.djl.spring:djl-spring-boot-starter-autoconfigure (>=0.18, <=0.23), ai.djl.spring:djl-spring-boot-starter-mxnet-auto (>=0.18, <=0.23) +8820 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (>=2.7.0, <=2.7.11)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.7.0, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =1.0, =0.8.38, =0.8.38, =v0.16.1, =v0.16.1, =v0.16.1, =1.0.0, =5.3.1, =6.2.1 and more Source cves: CVE-2023-20883 Source advisory: GHSA-XF96-W227-R7C4...

com.github.attt:archer-spring-autoconfigure (1.0-rc1), com.github.attt:archer-spring-boot-starter (1.0-rc1) +22 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.0.0.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.attt:archer-spring-autoconfigure 1.0-rc1...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +24 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.0.1.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.ebay:lightning-client 0.9.0 -...

io.fabric8:process-spring-boot-container (1.1.0.cr2), io.fabric8:process-spring-boot-itests-invoicing (1.1.0.cr2) +33 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.1.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - io.fabric8:process-spring-boot-container 1.1.0.cr2 ...

org.springframework.boot:spring-boot-actuator (1.1.2.release), org.springframework.boot:spring-boot-docs (1.1.2.release) +27 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.2.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.springframework.boot:spring-boot-actuator...

com.erudika:para (1.8.0), com.github.totyumengr:minicubes-cluster (0.2) +54 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.4.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.erudika:para 1.8.0 -...

org.grails:grails-gsp-spring-boot (1.0.0), org.springframework.boot:spring-boot-actuator (1.1.11.release) +28 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.1.11.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - org.grails:grails-gsp-spring-boot 1.0.0 -...

com.github.jlgrock.snp:client (0.1), com.github.jlgrock.snp:core (0.1) +77 more potentially affected by CVE-2023-20883 via org.springframework.boot:spring-boot-autoconfigure (1.2.0.release)

org.springframework.boot:spring-boot-autoconfigure MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-autoconfigure and may be impacted: - com.github.jlgrock.snp:client 0.1 -...