Description
Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Integration | 5.0 – < v5.0.10.RELEASE, 5.1 – < v5.1.1.RELEASE, 4.3 – < v4.3.18.RELEASE | v5.0.10.RELEASE |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.integration:spring-integration-ws | < 4.3.19 | 4.3.19 | GHSA-wr5r-m8pc-85j9 |
| Maven | org.springframework.integration:spring-integration-ws | >= 5.0.0, < 5.0.11 | 5.0.11 | GHSA-wr5r-m8pc-85j9 |
| Maven | org.springframework.integration:spring-integration-ws | >= 5.1.0, < 5.1.2 | 5.1.2 | GHSA-wr5r-m8pc-85j9 |
| Maven | org.springframework.integration:spring-integration-xml | < 4.3.19 | 4.3.19 | GHSA-wr5r-m8pc-85j9 |
| Maven | org.springframework.integration:spring-integration-xml | >= 5.0.0, < 5.0.11 | 5.0.11 | GHSA-wr5r-m8pc-85j9 |
| Maven | org.springframework.integration:spring-integration-xml | >= 5.1.0, < 5.1.2 | 5.1.2 | GHSA-wr5r-m8pc-85j9 |
Advisories 1
- WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024