Insecure Session Management

spring-vault-core is vulnerable to Insecure Session Management. The vulnerability exists because the library does not properly hide sensitive information from logs after a revocation failure, which allows an attacker to insert sensitive information into a log file when it attempts to revoke a Vau...

org.apereo.cas:cas-server-core-configuration-cloud-vault (>=5.2.0-rc2, <=5.2.9), org.springframework.cloud:spring-cloud-starter-vault-config (1.0.2.release) +5 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.0.2.release)

org.springframework.vault:spring-vault-core MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-vault...

io.pivotal.spring.cloud:spring-cloud-vault-localconfig-connector (1.0.0.release), net.nemerosa.ontrack:ontrack-extension-vault (>=experimental-pipeline-a6e0b79, <=3.41-beta.18) +9 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.1.1.release)

org.springframework.vault:spring-vault-core MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - io.pivotal.spring.cloud:spring-cloud-vault-localconfig-connector...

org.apereo.cas:cas-server-core-configuration-cloud-vault (5.2.0-rc1) potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.0.1.release)

org.springframework.vault:spring-vault-core MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-vault 5.2.0-rc...

org.apache.camel.quarkus:camel-quarkus-hashicorp-vault (3.0.0-m1), org.apache.camel.quarkus:camel-quarkus-hashicorp-vault-deployment (3.0.0-m1) +11 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (3.0.0)

org.springframework.vault:spring-vault-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apache.camel.quarkus:camel-quarkus-hashicorp-vault 3.0.0-m1 -...

com.bpfaas:bps-config-server-spring-cloud-starter (>=0.0.1.release, <=3.2.2), com.github.paulcwarren:spring-content-encryption (>=2.7.0, <=2.9.0) +137 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (>=2.0.1.release, <=2.3.2)

org.springframework.vault:spring-vault-core MAVEN version =2.0.1.release, =0.0.1.release, =2.7.0, =0.8, =0.8, =0.8, =0.8, =2.4.0, =0.9.1, =0.9.12, =0.10.2, =1.1.6, =1.2.16 and more Source cves: CVE-2023-20859 Source advisory: OSV:GHSA-R47R-87P9-8JH3...

org.springframework.cloud:spring-cloud-starter-vault-config (>=1.1.1.release, <=1.1.2.release), org.springframework.cloud:spring-cloud-vault-config (>=1.1.1.release, <=1.1.2.release) +4 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.1.2.release)

org.springframework.vault:spring-vault-core MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.springframework.cloud:spring-cloud-starter-vault-config...

org.apache.camel.quarkus:camel-quarkus-hashicorp-vault (3.0.0-m1), org.apache.camel.quarkus:camel-quarkus-hashicorp-vault-deployment (3.0.0-m1) +11 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (3.0.0)

org.springframework.vault:spring-vault-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apache.camel.quarkus:camel-quarkus-hashicorp-vault 3.0.0-m1 -...

org.springframework.cloud:spring-cloud-starter-vault-config (1.1.3.release), org.springframework.cloud:spring-cloud-vault-config (1.1.3.release) +4 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.1.3.release)

org.springframework.vault:spring-vault-core MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.springframework.cloud:spring-cloud-starter-vault-config...

com.bpfaas:bps-config-server-spring-cloud-starter (>=0.0.1.release, <=3.2.2), com.github.paulcwarren:spring-content-encryption (>=2.7.0, <=2.9.0) +137 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (>=2.0.1.release, <=2.3.2)

org.springframework.vault:spring-vault-core MAVEN version =2.0.1.release, =0.0.1.release, =2.7.0, =0.8, =0.8, =0.8, =0.8, =2.4.0, =0.9.1, =0.9.12, =0.10.2, =1.1.6, =1.2.16 and more Source cves: CVE-2023-20859 Source advisory: GHSA-R47R-87P9-8JH3...

com.bpfaas:bps-config-server-spring-cloud-starter (>=0.0.1.release, <=3.2.2), com.github.paulcwarren:spring-content-encryption (>=2.7.0, <=2.9.0) +138 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (>=1.0.0.release, <=2.3.2)

org.springframework.vault:spring-vault-core MAVEN version =1.0.0.release, =0.0.1.release, =2.7.0, =0.8, =0.8, =0.8, =0.8, =2.4.0, =0.9.1, =0.9.12, =0.10.2, =1.1.6, =1.2.16 and more Source cves: CVE-2023-20859 Source advisory: MEND:CVE-2023-20859...

org.apache.camel.quarkus:camel-quarkus-hashicorp-vault (3.0.0-m1), org.apache.camel.quarkus:camel-quarkus-hashicorp-vault-deployment (3.0.0-m1) +11 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (3.0.0)

org.springframework.vault:spring-vault-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apache.camel.quarkus:camel-quarkus-hashicorp-vault 3.0.0-m1 -...