Maven Advisories.

Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource

• XML external entities (XXE)

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

• Cross-site scripting (XSS)

>=4.0.0, <4.0.1 || >=3.0.0, <3.0.2 || <=2.5.1 · fixed in 4.0.1, 3.0.2

Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification

• Weak cryptography or TLS

>=4.0.0, <4.0.7 || >=3.5.0, <3.5.15 || >=3.4.0, <=3.4.16 · fixed in 4.0.7, 3.5.15

Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem

• Path traversal

>=7.0.0, <7.0.5 || >=6.5.0, <6.5.9 || >=6.4.0, <=6.4.11 || >=6.3.0, <=6.3.14 || <=5.5.20 · fixed in 7.0.5, 6.5.9

Spring Web Flow has Data Binding Vulnerability with Unified EL Parser

• Code injection

>=4.0.0, <4.0.1 || >=3.0.0, <3.0.2 || <=2.5.1 · fixed in 4.0.1, 3.0.2

Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set

• Path traversal

<=6.4-feature13197 · no fixed version yet

Acknowledgement extension out of memory

• Denial of service

>=5.0.0, <5.0.23 || >=6.0.0, <6.0.19 || >=7.0.0, <7.0.19 || >=8.0.0, <8.0.9 · fixed in 5.0.23, 6.0.19, 7.0.19, 8.0.9

Jenkins: Missing permission check allows unauthorized cancellation of queue items

• Broken access control

<2.555.3 || >=2.556, <2.568 · fixed in 2.555.3, 2.568

Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations

• Weak cryptography or TLS

<2.555.3 || >=2.556, <2.568 · fixed in 2.555.3, 2.568

Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

• Insecure deserialization

<2.555.3 || >=2.556, <2.568 · fixed in 2.555.3, 2.568

Jenkins exposes other users' timezone and view names to users with Overall/Read permission

• Broken access control

<2.555.3 || >=2.556, <2.568 · fixed in 2.555.3, 2.568

Jenkins: Stored XSS vulnerability in node offline cause description

• Cross-site scripting (XSS)

>=2.483, <2.568 · fixed in 2.568

Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"

• Open redirect

<2.555.3 || >=2.556, <2.568 · fixed in 2.555.3, 2.568

Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL

• Open redirect

<2.555.3 || >=2.556, <2.568 · fixed in 2.555.3, 2.568

Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL

• Open redirect

>=2.556, <2.568 || <2.555.3 · fixed in 2.568, 2.555.3

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

• Authentication bypass

>=6.5.0, <6.5.11 || >=6.4.0, <=6.4.13 || >=6.0.0, <=6.3.10 || >=5.8.0, <=5.8.16 || <=5.7.14 · fixed in 6.5.11

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

• Denial of service

>=4.0.0, <4.0.6 || >=3.3.0, <3.3.16 || >=3.2.0, <=3.2.13 || >=2.9.0, <=2.9.13 || <=2.8.11 · fixed in 4.0.6, 3.3.16

In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

• Insecure deserialization

>=4.0.0, <4.0.6 || >=3.3.0, <3.3.16 || >=3.2.0, <=3.2.13 || >=2.9.0, <=2.9.13 || <=2.8.11 · fixed in 4.0.6, 3.3.16

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

• Code injection

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.7.19 · fixed in 4.0.6, 3.5.12

Spring Data REST potentially exposes persistence-layer internals to HTTP clients

• Information disclosure

>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19 · fixed in 5.0.6, 4.5.12

Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

• Broken access control

>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19 · fixed in 5.0.6, 4.5.12

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

• Code injection

>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19 · fixed in 5.0.6, 4.5.12

Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

• Insecure deserialization

>=2.0.0, <2.0.6 || >=1.2.0, <1.2.18 || <=1.1.17 · fixed in 2.0.6, 1.2.18

Spring Data REST has Improper Access Control in its JSON Patch Implementation

• Broken access control

>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19 · fixed in 5.0.6, 4.5.12

Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

• Denial of service

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.7.19 · fixed in 4.0.6, 3.5.12

Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation

• CWE-20

>=4.0.0, <4.0.6 || >=3.3.0, <3.3.16 || >=3.2.0, <=3.2.13 || >=2.9.0, <=2.9.13 || <=2.8.11 · fixed in 4.0.6, 3.3.16

Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache

• Open redirect

>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23 · fixed in 7.0.6, 6.5.11

Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads

• Weak cryptography or TLS

>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.4.0, <=6.4.16 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23 · fixed in 7.0.6, 6.5.11

Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

• Weak cryptography or TLS

>=4.0.0, <4.0.4 || >=3.2.0, <3.2.11 || >=3.1.0, <=3.1.15 || <=2.4.17 · fixed in 4.0.4, 3.2.11

Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

• Weak cryptography or TLS

>=4.0.0, <4.0.4 || >=3.2.0, <3.2.11 || >=3.1.0, <=3.1.15 || <=2.4.17 · fixed in 4.0.4, 3.2.11

Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)

• Denial of service

>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.4.0, <=6.4.16 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23 · fixed in 7.0.6, 6.5.11

Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

• Other injection

>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.0.0, <=4.3.16 || <=3.4.19 · fixed in 5.0.6, 4.5.12

Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys

• Denial of service

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.3.0, <=3.3.16 || <=2.7.19 · fixed in 4.0.6, 3.5.12

Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

• Other injection

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.4.19 · fixed in 4.0.6, 3.5.12

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

• XML external entities (XXE)

>=4.0.0, <4.0.1 || >=3.0.0, <3.0.6 || <=2.0.8.RELEASE · fixed in 4.0.1, 3.0.6

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

• Code injection

>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.0.0, <=4.3.16 || <=3.4.19 · fixed in 5.0.6, 4.5.12

Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)

• Denial of service

>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.7.19 · fixed in 4.0.6, 3.5.12

Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter

• Open redirect

>=7.0.0, <7.0.6 || >=1.5.0, <1.5.8 · fixed in 7.0.6, 1.5.8

Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters

• Cross-site scripting (XSS)

>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.4.0, <=6.4.16 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23 · fixed in 7.0.6, 6.5.11

Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository

• Insecure deserialization

>=7.0.0, <7.0.6 · fixed in 7.0.6

Spring Framework Unsafe Deserialization via Jackson JMS Converters

• Insecure deserialization

<=5.3.39 || >=6.0.0, <=6.1.21 || >=6.2.0, <6.2.19 || >=7.0.0-M1, <7.0.8 · fixed in 6.2.19, 7.0.8

Spring Framework Denial of Service via Unbounded Cache in SpEL

• Denial of service

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

• Broken access control

<=5.3.39 · no fixed version yet

Spring Framework Algorithmic Denial of Service via SpEL Expressions

• Denial of service

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

• HTTP request smuggling

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Arbitrary Method Invocation in SpEL Expressions

• Broken access control

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Cross-site Scripting via JSP Form Tags

• Cross-site scripting (XSS)

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

• Server-side request forgery (SSRF)

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 · fixed in 7.0.8, 6.2.19

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

• Memory corruption

<=5.3.39 · no fixed version yet

Spring Framework Denial of Service via AntPathMatcher

• Denial of service

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

• Denial of service

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Predictable Session ID in WebSocket Module

• Weak cryptography or TLS

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.27 || <=5.3.48 · fixed in 7.0.8, 6.2.19

Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

• Hard-coded credentials

>=1.3.0, <1.3.6 || >=1.2.0, <1.2.18 || >=1.1.0, <=1.1.31 || >=1.0.0, <=1.0.48 · fixed in 1.3.6, 1.2.18

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

• CWE-524

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring LDAP has Authentication Bypass with Empty Password

• Authentication bypass

>=4.0.0, <4.0.4 || >=3.3.0, <3.3.8 || >=3.2.0, <=3.2.16 || <=2.4.4 · fixed in 4.0.4, 3.3.8

Spring Framework Open Redirect in Spring MVC and WebFlux

• Open redirect

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Denial of Service via Multipart Requests in WebFlux

• Denial of service

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

• Broken access control

>=3.0.0, <3.0.4 || >=2.5.0, <2.5.3 || >=2.3.0, <=2.3.4 || <=1.5.6 || >=2.4.0, <=2.4.1 · fixed in 3.0.4, 2.5.3

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

• Path traversal

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Spring Framework Escalation via Session Fixation in WebFlux

• Authentication bypass

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19