deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-j7j9-5253-f7vh
Package: com.ritense.valtimo:case (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 13.0.0, < 13.23.0
Patched in: 13.23.0

Summary: Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

Details:
### Summary

Multiple classes evaluate Spring Expression Language (SpEL) expressions from user-supplied input using `StandardEvaluationContext`, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration.

### Impact

An attacker with ADMIN credentials can:
- **Execute arbitrary OS commands** via `T(java.lang.Runtime).getRuntime().exec('...')`
- **Exfiltrate all environment variables** (database passwords, API keys, Keycloak secrets) via `T(java.lang.System).getenv()`
- **Read JVM system properties** via `T(java.lang.System).getProperties()`
- **Load arbitrary classes** via `T(java.lang.Class).forName('...')`

### Affected Components

**1. DocumentMigrationService** (since 12.0.0)

Exploitable through the document migration REST API:
- `POST /api/management/v1/document-definition/migrate`
- `POST /api/management/v1/document-definition/migration/conflicts`

The malicious SpEL expression is supplied in the `source` or `target` field of a `DocumentMigrationPatch` object in the request body, using the `${...}` template syntax.

- In 12.x: `com.ritense.document.service.DocumentMigrationService#handleSpelExpression` (document module)
- In 13.x: same class, moved to the case module

**2. Condition** (since 13.4.0)

Exploitable through any admin-configured widget, dashboard, or feature that uses the `Condition` framework. The SpEL expression is supplied in the `value` field of a condition's JSON configuration.

- `com.ritense.valtimo.contract.conditions.Condition#resolveValue` (contract module)

This component has a significantly wider attack surface than DocumentMigrationService, as conditions are used across many modules.

### Remediation

Replace `StandardEvaluationContext` with `SimpleEvaluationContext` in both affected classes, which disallows Java type references and arbitrary method invocation:

```kotlin
val evaluationContext = SimpleEvaluationContext
    .forPropertyAccessors(MapAccessor(), jsonPropertyAccessor)
    .build()
```
GitHub Security Advisory: GHSA-j7j9-5253-f7vh
Package: com.ritense.valtimo:document (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 12.0.0, < 12.32.0
Patched in: 12.32.0

Summary: Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

Details:
### Summary

Multiple classes evaluate Spring Expression Language (SpEL) expressions from user-supplied input using `StandardEvaluationContext`, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration.

### Impact

An attacker with ADMIN credentials can:
- **Execute arbitrary OS commands** via `T(java.lang.Runtime).getRuntime().exec('...')`
- **Exfiltrate all environment variables** (database passwords, API keys, Keycloak secrets) via `T(java.lang.System).getenv()`
- **Read JVM system properties** via `T(java.lang.System).getProperties()`
- **Load arbitrary classes** via `T(java.lang.Class).forName('...')`

### Affected Components

**1. DocumentMigrationService** (since 12.0.0)

Exploitable through the document migration REST API:
- `POST /api/management/v1/document-definition/migrate`
- `POST /api/management/v1/document-definition/migration/conflicts`

The malicious SpEL expression is supplied in the `source` or `target` field of a `DocumentMigrationPatch` object in the request body, using the `${...}` template syntax.

- In 12.x: `com.ritense.document.service.DocumentMigrationService#handleSpelExpression` (document module)
- In 13.x: same class, moved to the case module

**2. Condition** (since 13.4.0)

Exploitable through any admin-configured widget, dashboard, or feature that uses the `Condition` framework. The SpEL expression is supplied in the `value` field of a condition's JSON configuration.

- `com.ritense.valtimo.contract.conditions.Condition#resolveValue` (contract module)

This component has a significantly wider attack surface than DocumentMigrationService, as conditions are used across many modules.

### Remediation

Replace `StandardEvaluationContext` with `SimpleEvaluationContext` in both affected classes, which disallows Java type references and arbitrary method invocation:

```kotlin
val evaluationContext = SimpleEvaluationContext
    .forPropertyAccessors(MapAccessor(), jsonPropertyAccessor)
    .build()
```
GitHub Security Advisory: GHSA-37w2-q6vh-45v6
Package: org.springframework.grpc:spring-grpc (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: Spring gRPC AuthenticationException messages are reflected to remote client

Details:
The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.

Affected versions:
Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
GitHub Security Advisory: GHSA-4g9c-3x4p-mfpp
Package: org.springframework.grpc:spring-grpc (MAVEN)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-653: Improper Isolation or Compartmentalization
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: Spring gRPC SecurityContext leaks across requests upon authorization failure

Details:
When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions.

Affected versions:
Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
GitHub Security Advisory: GHSA-v6x6-pjxw-3pv2
Package: org.springframework.ai:spring-ai-advisors-vector-store (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 1.1.0, < 1.1.5
Patched in: 1.1.5

Summary: Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

Details:
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
GitHub Security Advisory: GHSA-v6x6-pjxw-3pv2
Package: org.springframework.ai:spring-ai-advisors-vector-store (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 1.0.0, < 1.0.6
Patched in: 1.0.6

Summary: Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

Details:
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
GitHub Security Advisory: GHSA-63c8-m9m2-cvr3
Package: org.springframework.ai:spring-ai-azure-cosmos-db-store (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 1.1.0, < 1.1.5
Patched in: 1.1.5

Summary: Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()

Details:
SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5).
GitHub Security Advisory: GHSA-63c8-m9m2-cvr3
Package: org.springframework.ai:spring-ai-azure-cosmos-db-store (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 1.0.0, < 1.0.6
Patched in: 1.0.6

Summary: Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()

Details:
SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5).
GitHub Security Advisory: GHSA-r5hp-3cgj-j6xv
Package: org.springframework.ai:spring-ai-transformers (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-377: Insecure Temporary File
Vulnerable versions: >= 1.1.0, < 1.1.5
Patched in: 1.1.5

Summary: Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory

Details:
In Spring AI, having access to a shared environment can expose the ONNX model used by the application.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
GitHub Security Advisory: GHSA-r5hp-3cgj-j6xv
Package: org.springframework.ai:spring-ai-transformers (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-377: Insecure Temporary File
Vulnerable versions: >= 1.0.0, < 1.0.6
Patched in: 1.0.6

Summary: Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory

Details:
In Spring AI, having access to a shared environment can expose the ONNX model used by the application.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
GitHub Security Advisory: GHSA-26gg-9gv2-v27j
Package: org.springframework.ai:spring-ai-pdf-document-reader (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 1.1.0, < 1.1.5
Patched in: 1.1.5

Summary: Spring AI Vulnerable to OOM by attacker-controlled PDF

Details:
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
GitHub Security Advisory: GHSA-26gg-9gv2-v27j
Package: org.springframework.ai:spring-ai-pdf-document-reader (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 1.0.0, < 1.0.6
Patched in: 1.0.6

Summary: Spring AI Vulnerable to OOM by attacker-controlled PDF

Details:
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
GitHub Security Advisory: GHSA-qc4j-qjqx-vr58
Package: org.springframework.ai:spring-ai-vector-store (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.1.0, < 1.1.5
Patched in: 1.1.5

Summary: Spring AI has a VectorStore FilterExpression Converter injection

Details:
In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
GitHub Security Advisory: GHSA-qc4j-qjqx-vr58
Package: org.springframework.ai:spring-ai-vector-store (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.0.0, < 1.0.6
Patched in: 1.0.6

Summary: Spring AI has a VectorStore FilterExpression Converter injection

Details:
In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
GitHub Security Advisory: GHSA-5368-6h4h-gr29
Package: org.springframework.boot:spring-boot-cassandra (MAVEN)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: <= 2.7.32
Patched in: unpatched

Summary: Spring Boot's PID file write follows symlinks at predictable default path

Details:
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-5368-6h4h-gr29
Package: org.springframework.boot:spring-boot-cassandra (MAVEN)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 3.3.0, <= 3.3.18
Patched in: unpatched

Summary: Spring Boot's PID file write follows symlinks at predictable default path

Details:
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-5368-6h4h-gr29
Package: org.springframework.boot:spring-boot-cassandra (MAVEN)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 3.4.0, <= 3.4.15
Patched in: unpatched

Summary: Spring Boot's PID file write follows symlinks at predictable default path

Details:
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-5368-6h4h-gr29
Package: org.springframework.boot:spring-boot-cassandra (MAVEN)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 3.5.0, < 3.5.14
Patched in: 3.5.14

Summary: Spring Boot's PID file write follows symlinks at predictable default path

Details:
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-5368-6h4h-gr29
Package: org.springframework.boot:spring-boot-cassandra (MAVEN)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 4.0.0, < 4.0.6
Patched in: 4.0.6

Summary: Spring Boot's PID file write follows symlinks at predictable default path

Details:
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-9vc8-qppq-wvxc
Package: org.springframework.boot:spring-boot-rabbitmq (MAVEN)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.5.0, < 3.5.14
Patched in: 3.5.14

Summary: Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker

Details:
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.
GitHub Security Advisory: GHSA-9vc8-qppq-wvxc
Package: org.springframework.boot:spring-boot-rabbitmq (MAVEN)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 4.0.0, < 4.0.6
Patched in: 4.0.6

Summary: Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker

Details:
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.
GitHub Security Advisory: GHSA-56v8-86gj-66jp
Package: org.springframework.boot:spring-boot-devtools (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: <= 2.7.32
Patched in: unpatched

Summary: Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

Details:
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-56v8-86gj-66jp
Package: org.springframework.boot:spring-boot-devtools (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 3.3.0, <= 3.3.18
Patched in: unpatched

Summary: Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

Details:
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-56v8-86gj-66jp
Package: org.springframework.boot:spring-boot-devtools (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 3.4.0, <= 3.4.15
Patched in: unpatched

Summary: Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

Details:
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-56v8-86gj-66jp
Package: org.springframework.boot:spring-boot-devtools (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 3.5.0, < 3.5.14
Patched in: 3.5.14

Summary: Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

Details:
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-56v8-86gj-66jp
Package: org.springframework.boot:spring-boot-devtools (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 4.0.0, < 4.0.6
Patched in: 4.0.6

Summary: Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

Details:
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-mqvw-jfmh-93qq
Package: org.springframework.boot:spring-boot-cassandra (MAVEN)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: <= 2.7.32
Patched in: unpatched

Summary: Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

Details:
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
GitHub Security Advisory: GHSA-mqvw-jfmh-93qq
Package: org.springframework.boot:spring-boot-cassandra (MAVEN)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 3.3.0, <= 3.3.18
Patched in: unpatched

Summary: Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

Details:
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.