Homepage

org.springframework.boot:spring-boot-autoconfigure@2.3.3.RELEASE

  • latest version

    4.1.0

  • latest non vulnerable version

    4.1.0

  • first published

    12 years ago

  • latest version published

    2 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.springframework.boot:spring-boot-autoconfigure package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Insecure Temporary File

    Affected versions of this package are vulnerable to Insecure Temporary File via the default data directory configuration in ArtemisEmbeddedConfigurationFactory. A local attacker can tamper with or redirect the embedded Artemis broker's data storage by pre-creating the predictable data directory or replacing it with a symlink before the application starts. This may allow unauthorized access to message data, injection of malicious messages, or further compromise through processing of attacker-controlled broker data.

    Note: This is only exploitable by an attacker with local access to the host system before the application initializes the embedded broker.

    How to fix Insecure Temporary File?

    Upgrade org.springframework.boot:spring-boot-autoconfigure to version 3.5.15, 4.0.7, 4.1.0 or higher.

    [,3.5.15)[4.0.0-M1,4.0.7)[4.1.0-M1,4.1.0)
    • C
    Improper Validation of Certificate with Host Mismatch

    Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to establishing SSL connections to Cassandra without verifying that the hostname in the server's SSL certificate actually matched the hostname of the server being connected to. While the application might have verified that the certificate was signed by a trusted Certificate Authority (CA), failing to verify the hostname means an attacker could present any valid certificate (even one meant for a different domain) to successfully intercept the connection, leaving the application vulnerable to Man-in-the-Middle (MitM) attacks.

    How to fix Improper Validation of Certificate with Host Mismatch?

    Upgrade org.springframework.boot:spring-boot-autoconfigure to version 3.5.14, 4.0.6 or higher.

    [,3.5.14)[4.0.0-M1,4.0.6)
    • H
    Denial of Service (DoS)

    Affected versions of this package are vulnerable to Denial of Service (DoS) if Spring MVC is used together with a reverse proxy cache.

    Specifically, an application is vulnerable if all of the conditions are true:

    • The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath.
    • The application uses Spring Boot's welcome page support, either static or templated.
    • The application is deployed behind a proxy which caches 404 responses.

    The application is NOT vulnerable if any of the following are true:

    • Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfiguration is explicitly excluded, if Spring MVC is not on the classpath, or if spring.main.web-application-type is set to a value other than SERVLET.
    • The application does not use Spring Boot's welcome page support.
    • There is no proxy which caches 404 responses.

    How to fix Denial of Service (DoS)?

    Upgrade org.springframework.boot:spring-boot-autoconfigure to version 2.5.15, 2.6.15, 2.7.12, 3.0.7 or higher.

    [,2.5.15)[2.6.0,2.6.15)[2.7.0,2.7.12)[3.0.0,3.0.7)
    Go back to all versions of this package