MEDIUM 5.0
GHSA-9wxp-w4px-32vh
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Quick fix
GHSA-9wxp-w4px-32vh — org.springframework.boot:spring-boot-starter-mail: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.0.7</version> for org.springframework.boot:spring-boot-starter-mailDetails
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.springframework.boot:spring-boot-starter-mail
Introduced in:
4.0.0 Fixed in: 4.0.7 Fix
# pom.xml: bump <version>4.0.7</version> for org.springframework.boot:spring-boot-starter-mail Maven / org.springframework.boot:spring-boot-starter-mail
Introduced in:
3.5.0 Fixed in: 3.5.15 Fix
# pom.xml: bump <version>3.5.15</version> for org.springframework.boot:spring-boot-starter-mail Maven / org.springframework.boot:spring-boot-starter-mail
Introduced in:
3.4.0 No fixed version published yet for org.springframework.boot:spring-boot-starter-mail (maven). Pin to a known-safe version or switch to an alternative.