Homepage

org.springframework:spring-oxm@4.0.1.RELEASE vulnerabilities

  • latest version

    6.2.1

  • latest non vulnerable version

    6.2.1

  • first published

    15 years ago

  • latest version published

    14 days ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.springframework:spring-oxm package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Denial of Service (DoS)

    org.springframework:spring-oxm is a Spring Object/XML Marshalling library.

    Affected versions of this package are vulnerable to Denial of Service (DoS). It does not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

    How to fix Denial of Service (DoS)?

    Upgrade org.springframework:spring-oxm to version 3.2.14.RELEASE, 4.1.7.RELEASE or higher.

    [3.2.0.RELEASE,3.2.14.RELEASE)[4.0.0.RELEASE,4.1.7.RELEASE)
    • H
    XML External Entity (XXE) Injection

    org.springframework:spring-oxm is a Spring Object/XML Marshalling library.

    Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. This is due to not disabling the resolution of URI references by default in a DTD declaration. This occurs only when processing user provided XML documents.

    How to fix XML External Entity (XXE) Injection?

    Upgrade org.springframework:spring-oxm to version 3.2.9.RELEASE, 4.0.5.RELEASE or higher.

    [3.0.0.RELEASE,3.2.9.RELEASE)[4.0.0.RELEASE,4.0.5.RELEASE)
    Go back to all versions of this package