GHSA-wr5r-m8pc-85j9

Source

https://github.com/advisories/GHSA-wr5r-m8pc-85j9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-wr5r-m8pc-85j9/GHSA-wr5r-m8pc-85j9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wr5r-m8pc-85j9

Aliases

CVE-2019-3772

Published

2019-01-25T16:18:49Z

Modified

2024-11-30T05:27:23Z

Summary

Improper Restriction of XML External Entity Reference in org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml

Details

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Database specific

{
    "cwe_ids": [
        "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T22:01:07Z",
    "nvd_published_at": null,
    "severity": "LOW"
}

References

Affected packages

Maven

org.springframework.integration:spring-integration-xml

Package

Name: org.springframework.integration:spring-integration-xml; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-xml

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.3.19

Affected versions

1.*

1.0.1.RELEASE

1.0.2.RELEASE

1.0.2.SR1

1.0.3.RELEASE

1.0.4.RELEASE

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE

2.0.6.RELEASE

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

2.1.4.RELEASE

2.1.5.RELEASE

2.1.6.RELEASE

2.2.0.RELEASE

2.2.1.RELEASE

2.2.2.RELEASE

2.2.3.RELEASE

2.2.4.RELEASE

2.2.5.RELEASE

2.2.6.RELEASE

2.2.7.RELEASE

3.*

3.0.0.RELEASE

3.0.1.RELEASE

3.0.2.RELEASE

3.0.3.RELEASE

3.0.4.RELEASE

3.0.5.RELEASE

3.0.6.RELEASE

3.0.7.RELEASE

3.0.8.RELEASE

4.*

4.0.0.RELEASE

4.0.1.RELEASE

4.0.2.RELEASE

4.0.3.RELEASE

4.0.4.RELEASE

4.0.5.RELEASE

4.0.6.RELEASE

4.0.7.RELEASE

4.0.8.RELEASE

4.0.9.RELEASE

4.1.0.RELEASE

4.1.1.RELEASE

4.1.2.RELEASE

4.1.3.RELEASE

4.1.4.RELEASE

4.1.5.RELEASE

4.1.6.RELEASE

4.1.7.RELEASE

4.1.8.RELEASE

4.1.9.RELEASE

4.2.0.RELEASE

4.2.1.RELEASE

4.2.2.RELEASE

4.2.3.RELEASE

4.2.4.RELEASE

4.2.5.RELEASE

4.2.6.RELEASE

4.2.7.RELEASE

4.2.8.RELEASE

4.2.9.RELEASE

4.2.11.RELEASE

4.2.12.RELEASE

4.2.13.RELEASE

4.3.0.RELEASE

4.3.1.RELEASE

4.3.2.RELEASE

4.3.4.RELEASE

4.3.5.RELEASE

4.3.6.RELEASE

4.3.7.RELEASE

4.3.8.RELEASE

4.3.9.RELEASE

4.3.10.RELEASE

4.3.11.RELEASE

4.3.12.RELEASE

4.3.13.RELEASE

4.3.14.RELEASE

4.3.15.RELEASE

4.3.16.RELEASE

4.3.17.RELEASE

4.3.18.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-wr5r-m8pc-85j9/GHSA-wr5r-m8pc-85j9.json"

org.springframework.integration:spring-integration-xml

Package

Name: org.springframework.integration:spring-integration-xml; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-xml

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.0.11

Affected versions

5.*

5.0.0.RELEASE

5.0.1.RELEASE

5.0.2.RELEASE

5.0.3.RELEASE

5.0.4.RELEASE

5.0.5.RELEASE

5.0.6.RELEASE

5.0.7.RELEASE

5.0.8.RELEASE

5.0.9.RELEASE

5.0.10.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-wr5r-m8pc-85j9/GHSA-wr5r-m8pc-85j9.json"

org.springframework.integration:spring-integration-xml

Package

Name: org.springframework.integration:spring-integration-xml; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-xml

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.1.0

Fixed

5.1.2

Affected versions

5.*

5.1.0.RELEASE

5.1.1.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-wr5r-m8pc-85j9/GHSA-wr5r-m8pc-85j9.json"

org.springframework.integration:spring-integration-ws

Package

Name: org.springframework.integration:spring-integration-ws; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-ws

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.3.19

Affected versions

1.*

1.0.1.RELEASE

1.0.2.RELEASE

1.0.2.SR1

1.0.3.RELEASE

1.0.4.RELEASE

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE

2.0.6.RELEASE

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

2.1.4.RELEASE

2.1.5.RELEASE

2.1.6.RELEASE

2.2.0.RELEASE

2.2.1.RELEASE

2.2.2.RELEASE

2.2.3.RELEASE

2.2.4.RELEASE

2.2.5.RELEASE

2.2.6.RELEASE

2.2.7.RELEASE

3.*

3.0.0.RELEASE

3.0.1.RELEASE

3.0.2.RELEASE

3.0.3.RELEASE

3.0.4.RELEASE

3.0.5.RELEASE

3.0.6.RELEASE

3.0.7.RELEASE

3.0.8.RELEASE

4.*

4.0.0.RELEASE

4.0.1.RELEASE

4.0.2.RELEASE

4.0.3.RELEASE

4.0.4.RELEASE

4.0.5.RELEASE

4.0.6.RELEASE

4.0.7.RELEASE

4.0.8.RELEASE

4.0.9.RELEASE

4.1.0.RELEASE

4.1.1.RELEASE

4.1.2.RELEASE

4.1.3.RELEASE

4.1.4.RELEASE

4.1.5.RELEASE

4.1.6.RELEASE

4.1.7.RELEASE

4.1.8.RELEASE

4.1.9.RELEASE

4.2.0.RELEASE

4.2.1.RELEASE

4.2.2.RELEASE

4.2.3.RELEASE

4.2.4.RELEASE

4.2.5.RELEASE

4.2.6.RELEASE

4.2.7.RELEASE

4.2.8.RELEASE

4.2.9.RELEASE

4.2.11.RELEASE

4.2.12.RELEASE

4.2.13.RELEASE

4.3.0.RELEASE

4.3.1.RELEASE

4.3.2.RELEASE

4.3.4.RELEASE

4.3.5.RELEASE

4.3.6.RELEASE

4.3.7.RELEASE

4.3.8.RELEASE

4.3.9.RELEASE

4.3.10.RELEASE

4.3.11.RELEASE

4.3.12.RELEASE

4.3.13.RELEASE

4.3.14.RELEASE

4.3.15.RELEASE

4.3.16.RELEASE

4.3.17.RELEASE

4.3.18.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-wr5r-m8pc-85j9/GHSA-wr5r-m8pc-85j9.json"

org.springframework.integration:spring-integration-ws

Package

Name: org.springframework.integration:spring-integration-ws; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-ws

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.0.11

Affected versions

5.*

5.0.0.RELEASE

5.0.1.RELEASE

5.0.2.RELEASE

5.0.3.RELEASE

5.0.4.RELEASE

5.0.5.RELEASE

5.0.6.RELEASE

5.0.7.RELEASE

5.0.8.RELEASE

5.0.9.RELEASE

5.0.10.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-wr5r-m8pc-85j9/GHSA-wr5r-m8pc-85j9.json"

org.springframework.integration:spring-integration-ws

Package

Name: org.springframework.integration:spring-integration-ws; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-ws

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.1.0

Fixed

5.1.2

Affected versions

5.*

5.1.0.RELEASE

5.1.1.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-wr5r-m8pc-85j9/GHSA-wr5r-m8pc-85j9.json"