VDB
KO
HIGH 7.5

GHSA-9fw2-h3hf-293r

Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys

Quick fix

GHSA-9fw2-h3hf-293r — org.springframework.data:spring-data-commons: upgrade to the fixed version with the command below. 

# pom.xml: bump <version>4.0.6</version> for org.springframework.data:spring-data-commons

Details

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.

Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / org.springframework.data:spring-data-commons
Introduced in: 4.0.0 Fixed in: 4.0.6
Fix # pom.xml: bump <version>4.0.6</version> for org.springframework.data:spring-data-commons
Maven / org.springframework.data:spring-data-commons
Introduced in: 3.5.0 Fixed in: 3.5.12
Fix # pom.xml: bump <version>3.5.12</version> for org.springframework.data:spring-data-commons
Maven / org.springframework.data:spring-data-commons
Introduced in: 3.4.0

No fixed version published yet for org.springframework.data:spring-data-commons (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.data:spring-data-commons
Introduced in: 3.3.0

No fixed version published yet for org.springframework.data:spring-data-commons (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.data:spring-data-commons
Introduced in: 0

No fixed version published yet for org.springframework.data:spring-data-commons (maven). Pin to a known-safe version or switch to an alternative.

References