~ / search / GHSA-3wc8-659g-r88q

GHSA-3wc8-659g-r88q

Low severity vulnerability that affects org.springframework.batch:spring-batch-core

Source: GitHub Advisory Database (reviewed) Low CVE-2019-3774

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework.batch:spring-batch-core < 3.0.10.RELEASE 3.0.10.RELEASE
Maven org.springframework.batch:spring-batch-core >= 4.0.0.RELEASE, < 4.0.2.RELEASE 4.0.2.RELEASE
Maven org.springframework.batch:spring-batch-core >= 4.1.0.RELEASE, < 4.1.1.RELEASE 4.1.1.RELEASE

Details

As written in the advisory (Markdown source, shown as plain text).

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

References

External links from the advisory. They lead to third-party sites.