GHSA-5q8m-mqmx-pxp9

Source

https://github.com/advisories/GHSA-5q8m-mqmx-pxp9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-5q8m-mqmx-pxp9/GHSA-5q8m-mqmx-pxp9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5q8m-mqmx-pxp9

Aliases

CVE-2018-1274

Published

2018-10-17T17:23:44Z

Modified

2024-03-04T20:16:45.123315Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation

Details

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).

Database specific

{
    "nvd_published_at": "2018-04-18T16:29:00Z",
    "cwe_ids": [
        "CWE-770"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:17:03Z"
}

References

Affected packages

Maven / org.springframework.data:spring-data-commons

Package

Name: org.springframework.data:spring-data-commons; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-commons

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.13.11

Affected versions

1.*

1.5.0.RELEASE

1.5.1.RELEASE

1.5.2.RELEASE

1.5.3.RELEASE

1.6.0.RELEASE

1.6.1.RELEASE

1.6.2.RELEASE

1.6.3.RELEASE

1.6.4.RELEASE

1.6.5.RELEASE

1.7.0.RELEASE

1.7.1.RELEASE

1.7.2.RELEASE

1.7.3.RELEASE

1.8.0.RELEASE

1.8.1.RELEASE

1.8.2.RELEASE

1.8.4.RELEASE

1.8.5.RELEASE

1.8.6.RELEASE

1.9.0.RELEASE

1.9.1.RELEASE

1.9.2.RELEASE

1.9.3.RELEASE

1.9.4.RELEASE

1.10.0.RELEASE

1.10.1.RELEASE

1.10.2.RELEASE

1.11.0.RELEASE

1.11.1.RELEASE

1.11.2.RELEASE

1.11.4.RELEASE

1.11.5.RELEASE

1.11.6.RELEASE

1.12.0.RELEASE

1.12.1.RELEASE

1.12.2.RELEASE

1.12.3.RELEASE

1.12.4.RELEASE

1.12.5.RELEASE

1.12.6.RELEASE

1.12.7.RELEASE

1.12.8.RELEASE

1.12.9.RELEASE

1.12.10.RELEASE

1.12.11.RELEASE

1.13.0.RELEASE

1.13.1.RELEASE

1.13.2.RELEASE

1.13.3.RELEASE

1.13.4.RELEASE

1.13.5.RELEASE

1.13.6.RELEASE

1.13.7.RELEASE

1.13.8.RELEASE

1.13.9.RELEASE

1.13.10.RELEASE

Maven / org.springframework.data:spring-data-commons

Package

Name: org.springframework.data:spring-data-commons; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-commons

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.6

Affected versions

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.2.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE