org.springframework:spring-core@2.5.2 vulnerabilities

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to String.toLowerCase() having some Locale dependent exceptions that could potentially result in fields not protected as expected.

Note: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive.

Upgrade org.springframework:spring-core to version 6.1.14 or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Improper Input Validation when a user provides malicious input, causing insertion of additional log entries.

Upgrade org.springframework:spring-core to version 5.2.19.RELEASE, 5.3.14 or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs when a user provides malicious input, causing insertion of additional log entries.

Upgrade org.springframework:spring-core to version 5.3.12, 5.2.18 or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Expression Language Injection. When a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."

Upgrade org.springframework:spring-core to version 2.5.6.SEC03, 3.0.6 or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Arbitrary Code Execution, via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

Upgrade org.springframework:spring-core to version 2.5.6.SEC01, 3.0.2.RELEASE or higher.

org.springframework:spring-core is a core package within the spring-framework that contains multiple classes and utilities.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks via the java.util.regex.Pattern.compile method. An attacker could use a long string with many optional groups to cause high cpu consumption. This is related to issue CVE-2004-2540.

Upgrade org.springframework:spring-core to version 2.5.6.SEC01 or higher.