Spring Tips: the road to Spring Framework 6: the new Ahead-of-Time Compilation Engine and GraalVM

Hi, Spring fans! Spring Boot 3 is here or will be tomorrow, on the 24th of November, 2022, to be more precise!, bringing a fantastic new Ahead-of-Time AOT compilation engine that supports GraalVM native images. Join me, and well dive deep into the engine and its interactions with the Spring...

This Week in Spring - November 22nd, 2022 - Spring Boot 3 and Thanksgiving edition!

Hi, Spring fans! Its Tuesday, the 22nd of November, 2022, as I write this, which means were two days away from Spring Boot 3 and Thanksgiving. Spring Boot 3, Ive written about in abundance so I wont rehash that. If you want to learn more about some of the amazing new features in Spring Framework ...

cn.smilevers:xxljob-spring-boot-starter (1.8.2-release) potentially affected by CVE-2022-43183 via com.xuxueli:xxl-job-core (1.8.2)

com.xuxueli:xxl-job-core MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.xuxueli:xxl-job-core and may be impacted: - cn.smilevers:xxljob-spring-boot-starter 1.8.2-release Source cves: CVE-2022-43183 Source advisory:...

This Week in Spring - November 15th, 2022

Hi, Spring fans! Howre you doin this fine Tuesday morning? Ive returned home to San Francisco and am up and at em nice and early to catch a flight to Seattle, where Ill speak at the Java User Group tonight. If youre in Seattle, dont miss it! Weve got a ton of cool stuff to get into this week, but...

ai.djl.spring:djl-spring-boot-starter-tensorflow-auto (>=0.15, <=0.18), ai.djl.tensorflow:tensorflow-api (>=0.15.0, <=0.18.0) +7176 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-java (>=3.17.0, <=3.19.5)

com.google.protobuf:protobuf-java MAVEN version =3.17.0, =0.15, =0.15.0, =0.15.0, =0.15.0, =3.32.1.6, =3.32.1.6-1-2.1, =3.32.1.6-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =1.0, =3.0.1-alpha, =2.8.4-alpha1, =3.0.1-alpha1 and more Source cves:...

io.github.talelin:lin-cms-spring-boot-autoconfigure (>=0.0.1-rc1, <=0.2.0-release), io.github.talelin:lin-cms-spring-boot-starter (>=0.0.1-rc1, <=0.2.0-release) potentially affected by CVE-2022-44244 via io.github.talelin:lin-cms-core (>=0.0.1-rc2, <=0.2.0-release)

io.github.talelin:lin-cms-core MAVEN version =0.0.1-rc2, =0.0.1-rc1, =0.0.1-rc1, =0.2.0-release Source cves: CVE-2022-44244 Source advisory: OSV:GHSA-4VRC-Q7M6-VQ7W...

io.github.talelin:lin-cms-spring-boot-autoconfigure (>=0.0.1-rc1, <=0.2.0-release), io.github.talelin:lin-cms-spring-boot-starter (>=0.0.1-rc1, <=0.2.0-release) potentially affected by CVE-2022-44244 via io.github.talelin:lin-cms-core (>=0.0.1-rc2, <=0.2.0-release)

io.github.talelin:lin-cms-core MAVEN version =0.0.1-rc2, =0.0.1-rc1, =0.0.1-rc1, =0.2.0-release Source cves: CVE-2022-44244 Source advisory: GHSA-4VRC-Q7M6-VQ7W...

Updates on Spring Cloud Stream 4.0.0 Schema Registry Support

This blog gives an update on the Schema Registry support that is part of Spring Cloud Stream version 4.0.x. Many enterprises use a schema registry for schema evolution use cases, such as the Confluent Schema Registry. Starting with version 1.1.x of Spring Cloud Stream until 3.0.0, we provided a...

CVE Report Published for Spring Tools

We have released STS 4.16.1 for Eclipse and Spring VSCode extensions 1.40.0 to address the following CVE report: - CVE-2022-31691: Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode Please review the information in the CVE report and upgrade immediately. Eclipse: STS...

CVE-2022-31691

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...

CVE-2022-31691: Improper Control of Generation of Code

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...

PT-2022-20891 · Spring · Spring Boot Tools +1

Name of the Vulnerable Software and Affected Versions: Spring Tools 4 for Eclipse version 4.16.0 and below Spring Boot Tools version 1.39.0 and below Concourse CI Pipeline Editor version 1.39.0 and below Bosh Editor version 1.39.0 and below Cloudfoundry Manifest YML Support version 1.39.0 and bel...

Exploit for Authorization Bypass Through User-Controlled Key in Vmware Spring_Security

CVE-2022-31692 Demo Overview A simple Spring Boot applicat...

Exploit for Authorization Bypass Through User-Controlled Key in Vmware Spring_Security

CVE-2022-31692 Demo Overview A simple Spring Boot applicat...

Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...

Bootiful Podcast: Spring Mad Scientist Andy Clement on SpringOne 2022, AOT, Azure Spring Apps, and more

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Spring mad scientist Andy Clement @andyclement about the new native support in Spring Boot 3, SpringOne 2022, and Azure Spring Apps, among other things...

Spring Tips: the road to Spring Boot 3: Spring Framework 6

Hi, Spring fans! In this installment, we begin a journey to Spring Boot 3, due end of November 2022. In this installment, well look - at a very high level - at some of the amazing features in Spring Framework 6, which underpins Spring Boot 3. Want to learn more about Spring Framework 6 and Spring...

Important: Red Hat Security Advisory: Red Hat Camel for Spring Boot 3.14.5 release and security update

A minor version update from 3.14.2 to 3.14.5 is now available for Camel for Spring Boot. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

This Week in Spring - October 25th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! When last we spoke, I was in Las Vegas, NV, for the JavaOne show. It was amazing! Im in sunny Singapore, then off to Malaysia and Thailand. Its the first time Ive been to any of these places since 2019! How good it is to be...

MAL-2022-6269 Malicious code in spring-boot-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24c0313226e487a37c9158c78bc620c0306eb778d0aa789677c0c77811785295 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...