This page lists Spring advisories.
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
Users of affected versions should upgrade to 0.9.5 (reactor-bom Dysprosium SR-5). No other steps are necessary.
This issue was…
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header in the response
where the filename attribute is derived from user supplied input.
Specifically, an application is vulnerable when all of the following are true:
An application is not vulnerable if any of the following is true:
Users of affected versions should apply the following mitigation. 5.2.x users should upgrade to 5.2.3. 5.1.x users should upgrade to 5.1.13. 5.0.x users should upgrade to 5.0.16. No other steps are necessary. Releases that have fixed this issue include:
This issue was identified and responsibly reported by Roman Shalymov from EPAM.
Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of “null”.
Users of affected versions should apply the following mitigation:
There are no other mitigation steps necessary.
This issue was identified and responsibly reported by Tim Büthe and Daniel Neagaru from mytaxi.
2019-06-19: Initial vulnerability report published
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
This vulnerability exposes applications that meet all of the following requirements:
@EnableAuthorizationServer)DefaultRedirectResolver in the AuthorizationEndpointThis vulnerability does not expose applications that:
RedirectResolver implementation other than DefaultRedirectResolver@EnableResourceServer)@EnableOAuthClient)Users of affected versions should apply the following mitigation:
There are no other mitigation steps necessary.
For users of Spring Boot 1.5.x and Spring IO Platform Cairo, it is highly recommended to override the spring-security-oauth version to the latest version containing the patch for the CVE. In order to override the version, you need to declare/set the property spring-security-oauth.version.
Below are instructions for users of Spring Boot 1.5.x.
To override a property using Maven, declare the property in your pom’s
To override a property using Gradle, configure the value in your build.gradle script:
ext['spring-security-oauth.version'] = '2.0.18.RELEASE'
Or in gradle.properties:
spring-security-oauth.version=2.0.18.RELEASE
NOTE: The same instructions apply for users of Spring IO Platform Cairo. However, the version to specify is 2.2.5.RELEASE.
This issue was identified and responsibly reported by Mike Noordermeer.
This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. Using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.
Users of affected versions should apply the following mitigation:
This issue was identified and responsibly reported by Thaveethu Vignesh
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Users of affected versions should apply the following mitigation:
This issue was identified and responsibly reported by Vern ([email protected] from PingAn Galaxy Lab).
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
VMware offers training and certification to turbo-charge your progress.
Learn moreTanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreCheck out all the upcoming events in the Spring community.
View all