GHSA-8222-6fc8-mhvf
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.ws:spring-ws | < 2.4.4 | 2.4.4 |
| Maven | org.springframework.ws:spring-ws | >= 3.0.0, < 3.0.6 | 3.0.6 |
| Maven | org.springframework.ws:spring-xml | < 2.4.4 | 2.4.4 |
| Maven | org.springframework.ws:spring-xml | >= 3.0.0, < 3.0.6 | 3.0.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-3773
- https://github.com/advisories/GHSA-8222-6fc8-mhvf
- https://pivotal.io/security/cve-2019-3773
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2021.html