GHSA-6j2q-c73v-97c5
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-gateway-server | >= 4.2.0, < 4.2.3 | 4.2.3 |
| Maven | org.springframework.cloud:spring-cloud-gateway-server | >= 4.1.0, < 4.1.8 | 4.1.8 |
| Maven | org.springframework.cloud:spring-cloud-gateway-server | >= 4.0.0, <= 4.0.9 | no fix listed |
| Maven | org.springframework.cloud:spring-cloud-gateway-server | < 3.1.10 | 3.1.10 |
| Maven | org.springframework.cloud:spring-cloud-gateway-server-mvc | >= 4.1.7, < 4.2.3 | 4.2.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
References
External links from the advisory. They lead to third-party sites.