You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Rohit Kumar (Jira)" <ji...@apache.org> on 2024/05/06 08:45:00 UTC
[jira] [Created] (HDDS-10815) Upgrade Spring Framework to 6.1.6/6.0.19/5.3.34 due to CVE-2024-22243, CVE-2024-22259 and CVE-2024-22262
Rohit Kumar created HDDS-10815:
----------------------------------
Summary: Upgrade Spring Framework to 6.1.6/6.0.19/5.3.34 due to CVE-2024-22243, CVE-2024-22259 and CVE-2024-22262
Key: HDDS-10815
URL: https://issues.apache.org/jira/browse/HDDS-10815
Project: Apache Ozone
Issue Type: Task
Components: build
Reporter: Rohit Kumar
Upgrade Spring Framework to 6.1.6/6.0.19/5.3.34 due to CVE-2024-22243, CVE-2024-22259 and CVE-2024-22262
CVE-2024-22243:- Applications that use {{UriComponentsBuilder}} to parse an externally provided URL (e.g. through a query parameter) _AND_ perform validation checks on the host of the parsed URL may be vulnerable to a [open redirect|https://cwe.mitre.org/data/definitions/601.html] attack or to a SSRF attack if the URL is used after passing validation checks.
[https://spring.io/security/cve-2024-22243]
[https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586]
CVE-2024-22262:- Affected versions of this package are vulnerable to Open Redirect when {{UriComponentsBuilder}} is used to parse an externally provided URL and perform validation checks on the host of the parsed URL.
[https://spring.io/security/cve-2024-22262]
[https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980]
CVE-2024-22259:- Affected versions of this package are vulnerable to Open Redirect when using {{UriComponentsBuilder}} to parse an externally provided {{URL}} and perform validation checks on the host of the parsed URL.
[https://spring.io/security/cve-2024-22259]
[https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org