GHSA-ggg2-9786-hwc8
Spring Boot: Predictable Temp Directory in Artemis Auto-configuration
Quick fix
GHSA-ggg2-9786-hwc8 — org.springframework.boot:spring-boot-autoconfigure: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.0.7</version> for org.springframework.boot:spring-boot-autoconfigureDetails
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
Are you affected?
Enter the version of the package you're using.
Affected packages
4.0.0 Fixed in: 4.0.7 # pom.xml: bump <version>4.0.7</version> for org.springframework.boot:spring-boot-autoconfigure 3.5.0 Fixed in: 3.5.15 # pom.xml: bump <version>3.5.15</version> for org.springframework.boot:spring-boot-autoconfigure 3.4.0 No fixed version published yet for org.springframework.boot:spring-boot-autoconfigure (maven). Pin to a known-safe version or switch to an alternative.
3.3.0 No fixed version published yet for org.springframework.boot:spring-boot-autoconfigure (maven). Pin to a known-safe version or switch to an alternative.
2.7.0 No fixed version published yet for org.springframework.boot:spring-boot-autoconfigure (maven). Pin to a known-safe version or switch to an alternative.