RHEL 7 : spring-webflow (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - spring-webflow: Data Binding Expression Vulnerability in Spring Web Flow CVE-2017-8039 - An issue was...

com.github.gfernandez598:springwebflow-optforrepl (=1.0), com.github.stephanarts:cas-server-integration-zeromq (>=0.0.1 <=0.0.8) +443 more potentially affected by CVE-2017-8039 via org.springframework.webflow:spring-webflow (>=2.0.6.RELEASE <=2.4.5.RELEASE)

org.springframework.webflow:spring-webflow MAVEN version =2.0.6.RELEASE, =0.0.1, =1.0, =1.0.0.RELEASE, =1.0, =1.0, =1.0.0-GA, =1.0.0-GA, =1.0.0-GA, =1.0.0-GA, =1.0.0-RC1 and more Source cves: CVE-2017-8039 Source advisory: OSV:GHSA-Q4V9-QJMW-J7VF...

com.github.gfernandez598:springwebflow-optforrepl (=1.0), fr.natsystem.natjet:natsys-nsworkflow (=7.0.19) +295 more potentially affected by CVE-2017-4971 via org.springframework.webflow:spring-webflow (>=2.4.0.RELEASE <=2.4.4.RELEASE)

org.springframework.webflow:spring-webflow MAVEN version =2.4.0.RELEASE, =1.0.0.RELEASE, =1.0, =1.0, =2.0.0-RC1, =2.0.0-RC1, =2.0.0-RC1, =2.0.0-RC1, =2.0.0-RC1, =5.0.0, =5.0.0, =5.1.9 and more Source cves: CVE-2017-4971 Source advisory: OSV:GHSA-FG9W-CFFM-PMH2...

Data Binding Expression Vulnerability

spring-webflow is vulnerable to a data binding expression vulnerability. The vulnerability is caused when the MvcViewFactoryCreator useSpringBinding property is set to false by default. Therefore, applications which use the default settings are vulnerable to malicious EL expressions in view state...

Spring WebFlow remote code execution vulnerability analysis(CVE-2017-4971)-vulnerability warning-the black bar safety net

In order to better and the majority of security enthusiasts, we build a community, the community mainly focused on the threats found and security data analysis and other fields, we hope to have more friends to join, together with the analysis of knowledge and common progress. Community address: ,...