VDB
KO
HIGH 7.5

GHSA-7fxc-486f-32q9

Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

Quick fix

GHSA-7fxc-486f-32q9 — org.springframework.hateoas:spring-hateoas: upgrade to the fixed version with the command below. 

# pom.xml: bump <version>3.0.4</version> for org.springframework.hateoas:spring-hateoas

Details

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations.

Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / org.springframework.hateoas:spring-hateoas
Introduced in: 3.0.0 Fixed in: 3.0.4
Fix # pom.xml: bump <version>3.0.4</version> for org.springframework.hateoas:spring-hateoas
Maven / org.springframework.hateoas:spring-hateoas
Introduced in: 2.5.0 Fixed in: 2.5.3
Fix # pom.xml: bump <version>2.5.3</version> for org.springframework.hateoas:spring-hateoas
Maven / org.springframework.hateoas:spring-hateoas
Introduced in: 2.3.0

No fixed version published yet for org.springframework.hateoas:spring-hateoas (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.hateoas:spring-hateoas
Introduced in: 0

No fixed version published yet for org.springframework.hateoas:spring-hateoas (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.hateoas:spring-hateoas
Introduced in: 2.4.0

No fixed version published yet for org.springframework.hateoas:spring-hateoas (maven). Pin to a known-safe version or switch to an alternative.

References