VDB
KO
HIGH 8.1

GHSA-gg69-9wwp-6jx2

Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

Quick fix

GHSA-gg69-9wwp-6jx2 — org.springframework.pulsar:spring-pulsar: upgrade to the fixed version with the command below. 

# pom.xml: bump <version>2.0.6</version> for org.springframework.pulsar:spring-pulsar

Details

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list.

Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 through 1.1.17.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / org.springframework.pulsar:spring-pulsar
Introduced in: 2.0.0 Fixed in: 2.0.6
Fix # pom.xml: bump <version>2.0.6</version> for org.springframework.pulsar:spring-pulsar
Maven / org.springframework.pulsar:spring-pulsar
Introduced in: 1.2.0 Fixed in: 1.2.18
Fix # pom.xml: bump <version>1.2.18</version> for org.springframework.pulsar:spring-pulsar
Maven / org.springframework.pulsar:spring-pulsar
Introduced in: 0

No fixed version published yet for org.springframework.pulsar:spring-pulsar (maven). Pin to a known-safe version or switch to an alternative.

References