Read the docs
Red Hat Security Advisory

RHSA-2018:1809

Red Hat OpenShift Application Runtimes Spring Boot security and bug fix update

Released 2018-06-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 3 records

TI-2018-01165 CVE-2018-1260 · GHSA-rrpm-pj7p-7j9q

Code injection in Pivotal Spring Security OAuth

Priority MEDIUM 55

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.10616 Published 2018-05-11 Partial fix · 2.3.3, 2.2.2 +2 CWE-94
TI-2018-01164 CVE-2018-1259 · GHSA-m929-7fr6-cvjg

XML external entity injection in Pivotal Spring Data Commons

Priority MEDIUM 41

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML exte…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04843 Published 2018-05-11 Fixed in 1.13.12, 2.0.7 CWE-611
TI-2018-01162 CVE-2018-1257 · GHSA-rcpf-vj53-7h2m

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and…

Priority MEDIUM 40

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through t…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03017 Published 2018-05-11 Partial fix · 5.0.6, 4.3.17