11844 matches found
ECHO-692B-622B-7965
Bulletin has no description...
ECHO-C993-31DB-A8BF
Bulletin has no description...
ECHO-47E4-5B68-7DD8
Bulletin has no description...
ECHO-74B5-8029-1A64
Bulletin has no description...
ECHO-4EBF-BC2C-395E
Bulletin has no description...
ECHO-C0AC-D14A-83AB
Bulletin has no description...
ECHO-1AE6-5677-99CD
Bulletin has no description...
ECHO-60B1-7D52-5AA4
Bulletin has no description...
ECHO-CEAB-F4E8-A26D
Bulletin has no description...
ECHO-14E3-A93D-99BA
Bulletin has no description...
ECHO-0BD2-8B5E-2B5A SoupCache ignores the HTTP Vary header when reusing cached responses. The vulnerable path is only reachable when a client explicitly enables the optional on-disk SoupCache feature (soup_session_add_feature with SoupCache) AND acts as a shared/multi-user HTTP proxy — neither applies to Echo's use of libsoup3 as a client library. No upstream fix exists (a TODO in soup_cache_has_response(); issue #453 was closed as a duplicate of the still-open upstream issue #112). Debian rates it no-dsa, Minor. https://security-tracker.debian.org/tracker/CVE-2025-9901
Bulletin has no description...
ECHO-CD7E-C6BA-0346
Bulletin has no description...
ECHO-13F8-D7EC-BFEF
Bulletin has no description...
ECHO-9599-97EA-884F
Bulletin has no description...
ECHO-668F-C580-6F98
Bulletin has no description...
ECHO-FBDF-61C2-28F4 CVE-2016-1000027 is published against `org.springframework:spring-web` and targets the Java-deserialization HTTP-Invoker family — specifically `org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter` and its `RemoteInvocationSerializingExporter` base, which call `ObjectInputStream.readObject()` directly on incoming HTTP-Invoker payloads. Spring's stated remediation is feature removal: the exporters were deprecated in v5.3.0 and deleted entirely in v6.0.0. The 6.1.x `spring-web` JAR this spec re-publishes therefore ships zero `HttpInvoker*` classes — verifiable with `unzip -l spring-web-6.1.21-echo.1.jar | grep -i HttpInvoker`, which returns nothing. Pinning a customer's classpath to `spring-web-6.1.21-echo.1` carries the vulnerable code's removal forward. Upstream Spring closed the underlying report against the framework as `status: invalid` (issue #24434): HTTP-Invoker is opt-in native Java serialization by design and was never intended to be exposed to untrusted clients. Customers still on the 5.3.x line need to either configure an `ObjectInputFilter` on the exporter or stop exposing the endpoint; the 6.0.0+ class removal — which the 6.1.x line this spec ships is past — covers everyone else. Spec-dir note: this entry lives under `packages/specs/java/spring-context/` because spring-context is the multi-module umbrella owner — its echobuild.yaml runs `./gradlew assemble` at the spring-framework repo root and produces the `spring-web-6.1.21-echo.1.jar` sibling output that this `not_applicable` statement scopes to. The `name:` above is what determines the OpenVEX product PURL, not the directory name (same pattern as `junrar-0.7/security.yaml` → `name: com.github.junrar:junrar`).
Bulletin has no description...
ECHO-70E5-AB74-3FEC
Bulletin has no description...
ECHO-4C7E-D60C-E7B1
Bulletin has no description...
ECHO-1569-0744-F0F7
Bulletin has no description...
ECHO-6871-872A-D66E
Bulletin has no description...
ECHO-F026-3251-8F2B
Bulletin has no description...
ECHO-C252-AE80-9DB0
Bulletin has no description...
ECHO-11BD-2260-C895
Bulletin has no description...
ECHO-5789-A454-B554
Bulletin has no description...
ECHO-9DAD-2609-2B54
Bulletin has no description...
ECHO-0FA5-4D4E-1A97
Bulletin has no description...
ECHO-B09A-BD3C-2713
Bulletin has no description...
ECHO-334B-1C04-AA69
Bulletin has no description...
ECHO-784E-1E87-235F
Bulletin has no description...
ECHO-0BBA-06EE-767F
Bulletin has no description...
ECHO-572D-1F26-2B99
Bulletin has no description...
ECHO-8C6A-E78A-B98A
Bulletin has no description...
ECHO-EE72-5202-2C87
Bulletin has no description...
ECHO-9B16-DC87-042E
Bulletin has no description...
ECHO-57EA-7CC7-5775
Bulletin has no description...
ECHO-6AEF-BC09-6CFF
Bulletin has no description...
ECHO-5B52-E7E7-A6C7
Bulletin has no description...
ECHO-196F-77DC-A314
Bulletin has no description...
ECHO-2BA2-F811-BA46
Bulletin has no description...
ECHO-DFC7-0C27-52D8
Bulletin has no description...
ECHO-7CA3-8F51-4D1C
Bulletin has no description...
ECHO-12B7-FB50-C92A
Bulletin has no description...
ECHO-53F9-F3DD-F28F
Bulletin has no description...
ECHO-1B44-AB67-111B
Bulletin has no description...
ECHO-94BD-88BB-49FE
Bulletin has no description...
ECHO-3FB6-F27A-A3F0
Bulletin has no description...
ECHO-F18E-D84C-3DA1
Bulletin has no description...
ECHO-C7D6-B5D9-8553
Bulletin has no description...