PT-2024-28229 · Spring+1 · Spring Boot+1

Yufan You · Published 2024-08-23 · Updated 2026-05-24 · CVE-2024-38807

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions 2.7.0 through 2.7.21 Spring Boot versions 3.0.0 through 3.0.16 Spring Boot versions 3.1.0 through 3.1.12 Spring Boot versions 3.2.0 through 3.2.8 Spring Boot versions 3.3.0 through 3.3.2

Description Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

Recommendations For Spring Boot versions 2.7.0 through 2.7.21, update to version 2.7.22 to resolve the issue. For Spring Boot versions 3.0.0 through 3.0.16, update to version 3.0.17 to resolve the issue. For Spring Boot versions 3.1.0 through 3.1.12, update to version 3.1.13 to resolve the issue. For Spring Boot versions 3.2.0 through 3.2.8, update to version 3.2.9 to resolve the issue. For Spring Boot versions 3.3.0 through 3.3.2, update to version 3.3.3 to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-347

CWE-290

Related Identifiers

CVE-2024-38807

GHSA-7CJ3-X93G-GJ76

Affected Products

Debian

Spring Boot

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2024-38807 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38807 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38807 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2024-38807 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-38807 · Security Note
• https://osv.dev/vulnerability/GHSA-7cj3-x93g-gj76 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-38807 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-38807 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38807 · Vendor Advisory
• https://github.com/spring-projects/spring-boot · Note
• https://t.me/cvenotify/91869 · Telegram Post
• https://t.me/cvedetector/3981 · Telegram Post
• https://twitter.com/oktsec/status/1826941027501920269 · Twitter Post
• https://twitter.com/CVEnew/status/1826902462239776850 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1826930094423564397 · Twitter Post