org.springframework.batch:spring-batch-core@4.0.2.RELEASE vulnerabilities

org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java.

Affected versions of this package are vulnerable to Insecure Defaults. When configured to enable default typing, Jackson contained a deserialization vulnerability (https://github.com/FasterXML/jackson-databind/issues/1599) that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets".

Spring Batch configures Jackson with global default typing enabled (https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization#11-global-default-typing) which means that through the previous exploit, arbitrary code could be executed if all of the following is true:

• Spring Batch’s Jackson support is being leveraged to serialize a job’s ExecutionContext.
• A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored).

Upgrade org.springframework.batch:spring-batch-core to version 4.2.3.RELEASE or higher.