EndpointRequest.to() creates a matcher for null/ if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed.
Your application may be affected by this if all the following conditions are met:
You use Spring Security EndpointRequest.to() has been used in a Spring Security chain configuration The endpoint which EndpointRequest references is disabled or not exposed via web Your application handles requests to /null and this path needs protection
You are not affected if any of the following is true:
You don't use Spring Security You don't use EndpointRequest.to() The endpoint which EndpointRequest.to() refers to is enabled and is exposed Your application does not handle requests to /null or this path does not need protection
End of life: 12/31/2023, Latest version: 3.0.13
End of life: 12/31/2023, Latest version: 3.0.13
End of life: 11/24/2022, Latest version: 2.6.15
End of life: 11/24/2022, Latest version: 2.6.15
End of life: 5/19/2022, Latest version: 2.5.15
End of life: 5/19/2022, Latest version: 2.5.15
End of life: 11/18/2021, Latest version: 2.4.13
End of life: 11/18/2021, Latest version: 2.4.13
End of life: 5/20/2021, Latest version: 2.3.12
End of life: 5/20/2021, Latest version: 2.3.12
End of life: 10/16/2020, Latest version: 2.2.13
End of life: 10/16/2020, Latest version: 2.2.13
End of life: 10/30/2019, Latest version: 2.1.18
End of life: 10/30/2019, Latest version: 2.1.18
Red Hat Openshift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.<br>This release of RHOAR Spring Boot 1.5.13 serves as a replacement for RHOAR Spring Boot 1.5.12, and includes bug fixes and enhancements. For further information, refer to the Release Notes linked to in the References section.<br>Security Fix(es):<br><li> spring-messaging: ReDoS Attack with spring-messaging (CVE-2018-1257)</li> <li> spring-data: XXE with Spring Data’s XMLBeam integration (CVE-2018-1259)</li> <li> spring-security-oauth2: Remote Code Execution with spring-security-oauth2 (CVE-2018-1260)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.