GHSA-xggx-fx6w-v7ch

Source

https://github.com/advisories/GHSA-xggx-fx6w-v7ch

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-xggx-fx6w-v7ch/GHSA-xggx-fx6w-v7ch.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-xggx-fx6w-v7ch

Aliases

CVE-2019-3802

Published

2019-06-04T15:42:15Z

Modified

2023-11-01T04:50:56.979497Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Improper Neutralization of Wildcards or Matching Symbols

Details

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Database specific

{
    "nvd_published_at": "2019-06-03T14:29:00Z",
    "github_reviewed_at": "2019-06-04T15:38:52Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-155",
        "CWE-200"
    ]
}

References

Affected packages

Maven / org.springframework.data:spring-data-jpa

Package

Name: org.springframework.data:spring-data-jpa; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-jpa

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0

Fixed

2.1.8

Affected versions

2.*

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

2.1.4.RELEASE

2.1.5.RELEASE

2.1.6.RELEASE

2.1.7.RELEASE

Maven / org.springframework.data:spring-data-jpa

Package

Name: org.springframework.data:spring-data-jpa; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-jpa

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.1.8

Affected versions

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.2.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE

2.0.6.RELEASE

2.0.7.RELEASE

2.0.8.RELEASE

2.0.9.RELEASE

2.0.10.RELEASE

2.0.11.RELEASE

2.0.12.RELEASE

2.0.13.RELEASE

2.0.14.RELEASE

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

2.1.4.RELEASE

2.1.5.RELEASE

2.1.6.RELEASE

2.1.7.RELEASE

Database specific

{
    "last_known_affected_version_range": "<= 2.0.14"
}

Maven / org.springframework.data:spring-data-jpa

Package

Name: org.springframework.data:spring-data-jpa; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.data/spring-data-jpa

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.22

Affected versions

1.*

1.0.0.RELEASE

1.0.1.RELEASE

1.0.2.RELEASE

1.0.3.RELEASE

1.1.0.RELEASE

1.1.1.RELEASE

1.1.2.RELEASE

1.2.0.RELEASE

1.2.1.RELEASE

1.3.0.RELEASE

1.3.1.RELEASE

1.3.2.RELEASE

1.3.3.RELEASE

1.3.4.RELEASE

1.3.5.RELEASE

1.4.0.RELEASE

1.4.1.RELEASE

1.4.2.RELEASE

1.4.3.RELEASE

1.4.4.RELEASE

1.4.5.RELEASE

1.5.0.RELEASE

1.5.1.RELEASE

1.5.2.RELEASE

1.5.3.RELEASE

1.6.0.RELEASE

1.6.1.RELEASE

1.6.2.RELEASE

1.6.4.RELEASE

1.6.5.RELEASE

1.6.6.RELEASE

1.7.0.RELEASE

1.7.1.RELEASE

1.7.2.RELEASE

1.7.3.RELEASE

1.7.4.RELEASE

1.8.0.RC1

1.8.0.RELEASE

1.8.1.RELEASE

1.8.2.RELEASE

1.9.0.RELEASE

1.9.1.RELEASE

1.9.2.RELEASE

1.9.4.RELEASE

1.9.5.RELEASE

1.9.6.RELEASE

1.10.0.RELEASE

1.10.1.RELEASE

1.10.2.RELEASE

1.10.3.RELEASE

1.10.4.RELEASE

1.10.5.RELEASE

1.10.6.RELEASE

1.10.7.RELEASE

1.10.8.RELEASE

1.10.9.RELEASE

1.10.10.RELEASE

1.10.11.RELEASE

1.11.0.RELEASE

1.11.1.RELEASE

1.11.2.RELEASE

1.11.3.RELEASE

1.11.4.RELEASE

1.11.5.RELEASE

1.11.6.RELEASE

1.11.7.RELEASE

1.11.8.RELEASE

1.11.9.RELEASE

1.11.10.RELEASE

1.11.11.RELEASE

1.11.12.RELEASE

1.11.13.RELEASE

1.11.14.RELEASE

1.11.15.RELEASE

1.11.16.RELEASE

1.11.17.RELEASE

1.11.18.RELEASE

1.11.20.RELEASE

1.11.21.RELEASE