What is GHSA-9qf9-28h9-hqcj?

GHSA-9qf9-28h9-hqcj is a security advisory published by GitHub Security Advisories with Critical severity. Remote code execution in PATCH requests in Spring Data REST

Which CVE IDs does GHSA-9qf9-28h9-hqcj cover?

GHSA-9qf9-28h9-hqcj covers the following CVE IDs: CVE-2017-8046. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9qf9-28h9-hqcj?

GHSA-9qf9-28h9-hqcj has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-9qf9-28h9-hqcj?

GHSA-9qf9-28h9-hqcj affects 2 products, including: maven/org.springframework.data:spring-data-rest-core:\u003c 2.6.9.RELEASE; maven/org.springframework.data:spring-data-rest-core:\u003e= 3.0.0, \u003c 3.0.1.RELEASE.

GHSA-9qf9-28h9-hqcjCriticalCVSS 9.8

Remote code execution in PATCH requests in Spring Data REST

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

February 2, 2023

🔗 CVE IDs covered (1)

CVE-2017-8046 →

📋 Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.

🎯 Affected products2

maven/org.springframework.data:spring-data-rest-core:< 2.6.9.RELEASE
maven/org.springframework.data:spring-data-rest-core:>= 3.0.0, < 3.0.1.RELEASE

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2017-8046
https://access.redhat.com/errata/RHSA-2018:2405
https://pivotal.io/security/cve-2017-8046
https://github.com/spring-projects/spring-data-rest/issues/1487
https://github.com/spring-projects/spring-data-rest/issues/1520
https://bugzilla.redhat.com/show_bug.cgi?id=1553024
https://jira.spring.io/browse/DATAREST-1127?redirect=false
https://github.com/advisories/GHSA-9qf9-28h9-hqcj