Security Exception in java.base/java.lang.String.repeat in spring-data-keyvalue
Summary
OSV-2023-1001: Security exception in java.base/java.lang.String.repeat. Affects spring-data-keyvalue versions >= 0d4a18fc90cf134d33a227bea68b6e2d9cad7541, < ee43ad3b43ee470a617c568522edf07f606b1516. Fixed in ee43ad3b43ee470a617c568522edf07f606b1516. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
spring-data-keyvalue is an open-source package that provides a high-level abstraction for working with key-value stores in Spring applications. It allows developers to interact with various key-value stores, such as Redis and Apache Geode, using a consistent API. This package is widely used in Spring projects to simplify data access and caching operations.
Vulnerability Detail
The vulnerability identified in spring-data-keyvalue is related to a security exception in the java.base/java.lang.String.repeat method. This vulnerability can be triggered when certain operations are performed in the package, specifically in the org.springframework.expression.spel.ast.OpMultiply.getValueInternal and org.springframework.expression.spel.ast.MethodReference.getArguments methods. The exact cause and impact of the vulnerability are further detailed in the OSS-Fuzz report (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63154). It is important to note that the severity of this vulnerability is classified as LOW.
How To Fix
Minimum fixed version
ee43ad3b43ee470a617c568522edf07f606b1516
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can avoid triggering the vulnerable code paths in the package. This can be achieved by carefully reviewing the code and ensuring that the specific operations mentioned in the vulnerability details are not performed. However, it is strongly recommended to apply the official fix by updating the package to a secure version.
Conclusion
In conclusion, the spring-data-keyvalue package is affected by a security exception vulnerability in the java.base/java.lang.String.repeat method. The vulnerability has a LOW severity level, but it is still crucial to update the package to a version that includes the fix. Applying the fix will ensure the security and stability of the application using spring-data-keyvalue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for spring-data-keyvalue →
FAQ
spring-data-keyvalue is an open-source package that provides a high-level abstraction for working with key-value stores in Spring applications. It simplifies data access and caching operations by offering a consistent API for interacting with various key-value stores.
The impact of this vulnerability is classified as LOW. However, it is still important to address it to ensure the security and stability of the application using spring-data-keyvalue.
To fix this vulnerability, update the spring-data-keyvalue package to a version that includes the fix. The fix was implemented in commit ee43ad3b43ee470a617c568522edf07f606b1516 in the spring-data-keyvalue repository.
Yes, as a workaround, developers can avoid triggering the vulnerable code paths in the package by carefully reviewing the code and ensuring that the specific operations mentioned in the vulnerability details are not performed. However, it is recommended to apply the official fix by updating the package to a secure version.
More information about this vulnerability can be found in the OSS-Fuzz report (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63154) and the source file (https://github.com/google/oss-fuzz-vulns/blob/main/vulns/spring-data-keyvalue/OSV-2023-1001.yaml).
