REDHAT-BUG-1670597: Medium severity Pivotal Spring Batch vulnerability
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
External References:
https://pivotal.io/security/cve-2019-3774
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1670597?
The severity of REDHAT-BUG-1670597 is considered critical due to the risk of XML External Entity Injection (XXE).
How do I fix REDHAT-BUG-1670597?
To fix REDHAT-BUG-1670597, upgrade to Spring Batch version 4.1.1 or newer or apply the recommended security patches if available.
What versions of Spring Batch are affected by REDHAT-BUG-1670597?
The affected versions of Spring Batch include 3.0.9, 4.0.1, 4.1.0, and any unsupported older versions.
What is XML External Entity Injection in the context of REDHAT-BUG-1670597?
XML External Entity Injection in REDHAT-BUG-1670597 refers to a vulnerability that allows attackers to exploit vulnerable XML parsers to access sensitive data or perform server-side request forgery.
Is there a workaround for REDHAT-BUG-1670597?
While the best solution is to upgrade to a fixed version, a temporary workaround may include sanitizing XML data from untrusted sources before processing.