PT-2019-16730 · Spring · Spring Data Jpa

Thaveethu Vignesh · Published 2019-06-03 · Updated 2021-10-29 · CVE-2019-3802

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Data JPA versions prior to 2.1.7 Spring Data JPA versions 2.0.x up to and including 2.0.14 Spring Data JPA versions 1.11.x up to and including 1.11.20

Description The issue affects the ExampleMatcher in Spring Data JPA, where using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING, or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Recommendations For Spring Data JPA versions prior to 2.1.7, update to version 2.1.7 or later. For Spring Data JPA versions 2.0.x up to and including 2.0.14, update to version 2.0.15 or later. For Spring Data JPA versions 1.11.x up to and including 1.11.20, update to version 1.11.21 or later.

Fix

Information Disclosure

Improper Neutralization of Wildcards

Weakness Enumeration

CWE-200

CWE-155

Related Identifiers

CVE-2019-3802

GHSA-XGGX-FX6W-V7CH

Affected Products

Spring Data Jpa

References · 5

• https://osv.dev/vulnerability/GHSA-xggx-fx6w-v7ch · Vendor Advisory
• https://pivotal.io/security/cve-2019-3802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3802 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3802 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3802 · Note