HIGH8.6
GHSA-6j2q-c73v-97c5
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Quick fix
GHSA-6j2q-c73v-97c5 — org.springframework.cloud:spring-cloud-gateway-server: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.2.3</version> for org.springframework.cloud:spring-cloud-gateway-serverDetails
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.springframework.cloud:spring-cloud-gateway-server
Introduced in:
4.2.0Fixed in: 4.2.3Fix
# pom.xml: bump <version>4.2.3</version> for org.springframework.cloud:spring-cloud-gateway-serverMaven/org.springframework.cloud:spring-cloud-gateway-server
Introduced in:
4.1.0Fixed in: 4.1.8Fix
# pom.xml: bump <version>4.1.8</version> for org.springframework.cloud:spring-cloud-gateway-serverMaven/org.springframework.cloud:spring-cloud-gateway-server
Introduced in:
4.0.0No fixed version published yet for org.springframework.cloud:spring-cloud-gateway-server (maven). Pin to a known-safe version or switch to an alternative.
Maven/org.springframework.cloud:spring-cloud-gateway-server
Introduced in:
0Fixed in: 3.1.10Fix
# pom.xml: bump <version>3.1.10</version> for org.springframework.cloud:spring-cloud-gateway-serverMaven/org.springframework.cloud:spring-cloud-gateway-server-mvc
Introduced in:
4.1.7Fixed in: 4.2.3Fix
# pom.xml: bump <version>4.2.3</version> for org.springframework.cloud:spring-cloud-gateway-server-mvc