Commits on Jul 1, 2022

1. create temp directory and RCE …

   spring-projects/spring-framework#27092
   1 . SynchronossPartHttpMessageReader should only create temp directory when needed 
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
   2. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

   

   duhanmin committed Jul 1, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 176954d
   • Browse repository at this point

   Copy the full SHA

   176954d View commit details

   Browse the repository at this point in the history