GHSA-439x-6767-44cv

Quick fix

GHSA-439x-6767-44cv — org.springframework.hateoas:spring-hateoas: upgrade to the fixed version with the command below.

# pom.xml: bump <version>3.0.4</version> for org.springframework.hateoas:spring-hateoas

Details

Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Introduced in: 3.0.0 Fixed in: 3.0.4

Fix # pom.xml: bump <version>3.0.4</version> for org.springframework.hateoas:spring-hateoas

Introduced in: 2.5.0 Fixed in: 2.5.3

Fix # pom.xml: bump <version>2.5.3</version> for org.springframework.hateoas:spring-hateoas

Introduced in: 2.3.0

No fixed version published yet for org.springframework.hateoas:spring-hateoas (maven). Pin to a known-safe version or switch to an alternative.

Introduced in: 0

No fixed version published yet for org.springframework.hateoas:spring-hateoas (maven). Pin to a known-safe version or switch to an alternative.

Introduced in: 2.4.0

No fixed version published yet for org.springframework.hateoas:spring-hateoas (maven). Pin to a known-safe version or switch to an alternative.