Most recent entries from all

certfr-2023-avi-0398 — De multiples vulnérabilités ont été découvertes dans les produits VMware Spring. Elles permettent à un attaquant de pro…

certfr-2023-avi-0398

EUVD-2026-210695

fkie_cve-2023-20883

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.

GHSA-xf96-w227-r7c4 — Spring Boot Welcome Page Denial of Service

Affected: Maven: org.springframework.boot:spring-boot-autoconfigure

Specifically, an application is vulnerable if all of the conditions are true:

* The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath. * The application makes use of Spring Boot's welcome page support, either static or templated. * Your application is deployed behind a proxy which caches 404 responses.

Your application is NOT vulnerable if any of the following are true:

* Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfiguration is explicitly excluded, if Spring MVC is not on the classpath, or if spring.main.web-application-type is set to a value other than SERVLET. * The application does not use Spring Boot's welcome page support. * You do not have a proxy which caches 404 responses.

Affected Spring Products and Versions

Spring Boot

3.0.0 to 3.0.6 2.7.0 to 2.7.11 2.6.0 to 2.6.14 2.5.0 to 2.5.14

Older, unsupported versions are also affected Mitigation

Users of affected versions should apply the following mitigations:

* 3.0.x users should upgrade to 3.0.7+ * 2.7.x users should upgrade to 2.7.12+ * 2.6.x users should upgrade to 2.6.15+ * 2.5.x users should upgrade to 2.5.15+

Users of older, unsupported versions should upgrade to 3.0.7+ or 2.7.12+…

gsd-2023-20883

RHSA-2023:3641 — Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release

snakeyaml: Denial of Service due to missing nested depth limitation for collections snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks dev-java/snakeyaml: DoS via stack overflow jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays mina-sshd: Java unsafe deserialization vulnerability CXF: directory listing / code exfiltration CXF: SSRF Vulnerability json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) jettison: Uncontrolled Recursion in JSONArray spring-boot: Spring Boot Welcome Page DoS Vulnerability

WID-SEC-W-2023-1247 — VMware Tanzu Spring Boot: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Boot ausnutzen, um einen Denial of Service Angriff durchzuführen.