Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN3YzgtNjU5Zy1yODhx

Low severity vulnerability that affects org.springframework.batch:spring-batch-core

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

Permalink: https://github.com/advisories/GHSA-3wc8-659g-r88q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN3YzgtNjU5Zy1yODhx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 5 years ago
Updated: over 1 year ago


Identifiers: GHSA-3wc8-659g-r88q, CVE-2019-3774
References: Blast Radius: 0.0

Affected Packages

maven:org.springframework.batch:spring-batch-core
Dependent packages: 225
Dependent repositories: 6,040
Downloads:
Affected Version Ranges: = 4.1.0, >= 4.0.0, < 4.0.2, < 3.0.10
Fixed in: 4.1.1, 4.0.2, 3.0.10
All affected versions:
All unaffected versions: 4.3.0, 4.3.1, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1