Skip to content

Bump org.apache.commons:commons-lang3 from 3.1 to 3.18.0 in /jOOQ#1

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/maven/jOOQ/org.apache.commons-commons-lang3-3.18.0
Open

Bump org.apache.commons:commons-lang3 from 3.1 to 3.18.0 in /jOOQ#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/maven/jOOQ/org.apache.commons-commons-lang3-3.18.0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Jul 31, 2025

Bumps org.apache.commons:commons-lang3 from 3.1 to 3.18.0.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump org.apache.commons:commons-lang3 from 3.1 to 3.18.0 in /jOOQ
9dffcbc 
Bumps org.apache.commons:commons-lang3 from 3.1 to 3.18.0.

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.18.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@jpeaks-eroad
Copy link
Copy Markdown

jpeaks-eroad commented Jul 31, 2025

Logo
Checkmarx One – Scan Summary & Details – 10efe534-3e3b-48df-91df-a92d5138ad2c

New Issues (47)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL CVE-2015-4852 Maven-commons-collections:commons-collections-3.2.1
detailsRecommended version: 3.2.2
Description: The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary comman...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: aK0DpAbXnd1MqBPAYuN%2BHM77%2FCnwmL3gJe9RX6Mi0Oc%3D
Vulnerable Package
CRITICAL CVE-2015-7501 Maven-commons-collections:commons-collections-3.2.1
detailsRecommended version: 3.2.2
Description: Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: E2YWsBt8pHy29W1rU4zOtWRQDh9IFwZI1FLL%2BZ5wi%2FA%3D
Vulnerable Package
CRITICAL CVE-2016-2170 Maven-commons-collections:commons-collections-3.2.1
detailsRecommended version: 3.2.2
Description: Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: YGYz7ZEn8znXbHg1wL%2FxcYRQGZSSY1G%2F%2BXjcIC6iKHM%3D
Vulnerable Package
CRITICAL CVE-2024-1597 Maven-org.postgresql:postgresql-9.2-1003-jdbc4
detailsRecommended version: 42.2.29
Description: The pgjdbc, the PostgreSQL JDBC Driver, allows an attacker to inject SQL if using "PreferQueryMode=SIMPLE". Note this is not the default. In the de...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: dY9Be7zrYLf%2B89oAodYGNwu9ar7Ni5c5NtsEmgowD6I%3D
Vulnerable Package
HIGH CVE-2014-3643 Maven-com.sun.jersey:jersey-core-1.0.2
detailsRecommended version: 1.13
Description: It was found that external parameter entities were not disabled by the jersey SAX parser. A remote attacker able to send XML requests to a jersey e...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 17SZj9gjZOFG48AQVDFNvM%2F%2F6egekWbY8S2YCrrwtbk%3D
Vulnerable Package
HIGH CVE-2015-6420 Maven-commons-collections:commons-collections-3.2.1
detailsRecommended version: 3.2.2
Description: Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, a...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: zQFJ1cDX%2FtemRDhcyNHtNqBgLnWBdD76bMK4A83ICR8%3D
Vulnerable Package
HIGH CVE-2016-5007 Maven-org.springframework:spring-core-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: Both Spring Security Core prior to 4.1.1 and Spring Core prior to 4.3.1, rely on URL pattern mappings for authorization and for mapping requests to...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: EL8rj927kWNfUPneDnieay1553ZO1nDh46ZhiJZdq60%3D
Vulnerable Package
HIGH CVE-2016-5007 Maven-org.springframework:spring-core-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: Both Spring Security Core prior to 4.1.1 and Spring Core prior to 4.3.1, rely on URL pattern mappings for authorization and for mapping requests to...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: hMqa4LXyTKLUhGzr3vfLbTjJcUXR28er35oZmjNdtMo%3D
Vulnerable Package
HIGH CVE-2022-4244 Maven-org.codehaus.plexus:plexus-utils-1.5.15
detailsRecommended version: 3.0.24
Description: A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outs...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: C0skNOhMNPNbZK5UHsy%2FNLts1Np9J%2B46clLSgsRGKMc%3D
Vulnerable Package
HIGH CVE-2022-45868 Maven-com.h2database:h2-1.3.174
detailsRecommended version: 2.2.220
Description: The web-based admin console in H2 Database Engine versions through 2.1.214 can be started via the CLI with the argument "-webAdminPassword", which ...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: 4ZGkURwykTOfODr%2FfSA%2FHkTr0ZK5yvNMz2VCgDZD%2F4c%3D
Vulnerable Package
HIGH CVE-2022-45868 Maven-com.h2database:h2-1.3.168
detailsRecommended version: 2.2.220
Description: The web-based admin console in H2 Database Engine versions through 2.1.214 can be started via the CLI with the argument "-webAdminPassword", which ...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: KvUvx9tO7GvAyql0Gc3oQfCg4A5NKa9Z6wK4KocLidI%3D
Vulnerable Package
HIGH CVE-2022-45868 Maven-com.h2database:h2-1.4.177
detailsRecommended version: 2.2.220
Description: The web-based admin console in H2 Database Engine versions through 2.1.214 can be started via the CLI with the argument "-webAdminPassword", which ...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: LvlZV5KoV2aBjd%2FaIcCZBEz8%2B%2BEAluLXgRzASA5S7LA%3D
Vulnerable Package
HIGH CVE-2022-45868 Maven-com.h2database:h2-1.4.181
detailsRecommended version: 2.2.220
Description: The web-based admin console in H2 Database Engine versions through 2.1.214 can be started via the CLI with the argument "-webAdminPassword", which ...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: UH6CwdlbbUXQbvj0n%2BqdRZv07xXAs9o7kjitF8YF0fQ%3D
Vulnerable Package
HIGH CVE-2022-45868 Maven-com.h2database:h2-1.3.176
detailsRecommended version: 2.2.220
Description: The web-based admin console in H2 Database Engine versions through 2.1.214 can be started via the CLI with the argument "-webAdminPassword", which ...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: vwz%2FdzDuN7P9TePSiLyHm4CWxeejvjrQ%2BOgp1oeRwQQ%3D
Vulnerable Package
HIGH CVE-2023-1436 Maven-org.codehaus.jettison:jettison-1.0.1
detailsRecommended version: 1.5.4
Description: An infinite recursion is triggered in Jettison prior to 1.5.4 when constructing a JSONArray from a Collection that contains a self-reference in one...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: xPG79u2pfdhC2kQPyZcZ%2B9C5JxWUXBh7G1y0P%2FQVYzc%3D
Vulnerable Package
HIGH CVE-2023-20883 Maven-org.springframework.boot:spring-boot-autoconfigure-1.1.7.RELEASE
detailsRecommended version: 2.5.15
Description: In org.springframework.boot:spring-boot-autoconfigure versions through 2.5.14, 2.6.0 through 2.6.14, 2.7.0 through 2.7.11, and 3.0.0 through 3.0.6 ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Xi4npQsjFVvvoQK%2BEVfnGAW13BU2Dv4yreYqITnIk6o%3D
Vulnerable Package
HIGH CVE-2023-26464 Maven-log4j:log4j-1.2.16
detailsRecommended version: 1.2.17.redhat-00008
Description: When using the Chainsaw or SocketAppender components with Log4j versions 1.0.4 prior to 2.0, an attacker that manages to cause a logging entry invo...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: McUndR7Y1YcczF0shiM5FNAkCNeG%2B1QGK0%2BXg5YVpik%3D
Vulnerable Package
HIGH CVE-2023-2976 Maven-com.google.guava:guava-15.0
detailsRecommended version: 32.0.0.jre-redhat-00001
Description: Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 through 31.1-jre on Unix syste...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: sTRyn3mPM7SAZ%2FnMX%2FX39dwSrFT%2FYJNlT7Bz7iy5x4I%3D
Vulnerable Package
HIGH CVE-2023-6378 Maven-ch.qos.logback:logback-classic-1.1.2
detailsRecommended version: 1.3.15
Description: A serialization vulnerability in logback receiver component part of logback versions prior to 1.2.13, 1.3.x prior to 1.3.12, and 1.4.x prior to 1.4...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: iJwjhlnhnBIDbtLmcbLG0G05vYvls3FUplMpyT3JrJU%3D
Vulnerable Package
HIGH CVE-2023-6378 Maven-ch.qos.logback:logback-core-1.1.2
detailsRecommended version: 1.3.15
Description: A serialization vulnerability in logback receiver component part of logback versions prior to 1.2.13, 1.3.x prior to 1.3.12, and 1.4.x prior to 1.4...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Pmei37HhtDuPxos1ngufKLT%2BYNw2pDo2DdwFluRea34%3D
Vulnerable Package
HIGH CVE-2023-6481 Maven-ch.qos.logback:logback-core-1.1.2
detailsRecommended version: 1.3.15
Description: A serialization vulnerability in logback receiver component part of logback versions through 1.2.12, 1.3.x through 1.3.13, and 1.4.x through 1.4.13...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: CL3xjAuZ%2FJymjgNGCRuM0itK5YvO7PzjINnl3tK083U%3D
Vulnerable Package
MEDIUM CVE-2022-4245 Maven-org.codehaus.plexus:plexus-utils-1.5.15
detailsRecommended version: 3.0.24
Description: A flaw was found in codehaus-plexus versions prior to 3.0.24. The 'org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment' fails to sanitize comme...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: MKEQUiV42OxB7Z9bTVG%2FIWcI2Q5vVzoPkUW30yB6ewc%3D
Vulnerable Package
MEDIUM CVE-2023-20861 Maven-org.springframework:spring-expression-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: In Spring Framework versions prior to 5.2.23.RELEASE, 5.3.x prior to 5.3.26 and 6.0.x prior to 6.0.7 it is possible for a user to provide a special...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 6bucmOEO0Khp3dnmviWOPfk8EXwo8bc26PH%2BSCIJd%2Bg%3D
Vulnerable Package
MEDIUM CVE-2023-20861 Maven-org.springframework:spring-expression-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: In Spring Framework versions prior to 5.2.23.RELEASE, 5.3.x prior to 5.3.26 and 6.0.x prior to 6.0.7 it is possible for a user to provide a special...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: iD53BsZtvLD2UfCIWWTlLFYC6P2po7pnABrreBfcyYw%3D
Vulnerable Package
MEDIUM CVE-2023-20863 Maven-org.springframework:spring-expression-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: In spring framework in versions through 5.2.23.RELEASE, 5.3.0-M1 through 5.3.26, and 6.0.0-M1 through 6.0.7 it is possible for a user to provide a ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 0NF8j%2BrqKY0UadzxymjJh6ouueDzAFzYD90%2FELA5KXc%3D
Vulnerable Package
MEDIUM CVE-2023-20863 Maven-org.springframework:spring-expression-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: In spring framework in versions through 5.2.23.RELEASE, 5.3.0-M1 through 5.3.26, and 6.0.0-M1 through 6.0.7 it is possible for a user to provide a ...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Ft66DWw6uXaSeP9DfS2zmRsKmeeyWGXpgFXeabpY4ck%3D
Vulnerable Package
MEDIUM CVE-2024-12798 Maven-ch.qos.logback:logback-core-1.1.2
detailsRecommended version: 1.3.15
Description: Arbitrary Code Execution vulnerability in "JaninoEventEvaluator" by QOS.CH logback in Java applications, allows attackers to execute arbitrary code...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: G%2FJTTe%2FDAQSRmsobX7AWbZSArgkyGDmKNby%2FLv%2BH%2F4g%3D
Vulnerable Package
MEDIUM CVE-2024-12798 Maven-ch.qos.logback:logback-classic-1.1.2
detailsRecommended version: 1.3.15
Description: Arbitrary Code Execution vulnerability in "JaninoEventEvaluator" by QOS.CH logback in Java applications, allows attackers to execute arbitrary code...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: qXXExKKMcJI5eQqMbtOAzXz2z%2BBjefjXKJA1op%2F0iWw%3D
Vulnerable Package
MEDIUM CVE-2024-38808 Maven-org.springframework:spring-expression-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: In Spring Framework versions through 5.3.38, a user can provide a specially crafted Spring Expression Language (SpEL) expression that may cause a D...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 4FVB%2F45c16dbWipjQ1hWnasNWQ04fDP%2Buy9qDlyr3Rw%3D
Vulnerable Package
MEDIUM CVE-2024-38808 Maven-org.springframework:spring-expression-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: In Spring Framework versions through 5.3.38, a user can provide a specially crafted Spring Expression Language (SpEL) expression that may cause a D...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: tlgktl0TVlhAAs6R%2FOk36xT5itp2wi%2F148nqA%2BK66eU%3D
Vulnerable Package
MEDIUM CVE-2025-48924 Maven-commons-lang:commons-lang-2.4
detailsDescription: Uncontrolled Recursion vulnerability in Apache Commons Lang. The methods `ClassUtils.getClass(...)` can `throwStackOverflowError` on very long inpu...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: e1Y5wRpSRsANkhP0%2FVePAdXe%2Fcqd5FaKb8uAMF7UZ20%3D
Vulnerable Package
LOW CVE-2024-12801 Maven-ch.qos.logback:logback-core-1.1.2
detailsRecommended version: 1.3.15
Description: Server-Side Request Forgery (SSRF) in "SaxEventRecorder" by QOS.CH logback on the Java platform, allows an attacker to forge requests by compromisi...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: FQ4sxP%2BW3eOJUM%2BiCGupYH56lZZKkyKTihIweUjEBdc%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-expression-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 17bbTHTSVZ1n%2FUuP0Cg%2BHJYAITqOuHVhvG6%2B%2BOfYL8M%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-expression-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 7FIUFynQctOEIux3B50jO7om0mgpuwSobY41Oopkomg%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-beans-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 7Sw7a1HioFOjZOA5GEB7tOdzeTsHA7TNvgUTDN%2BgmGI%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-beans-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 8kbnI95EXGbNHzY6KWPanpqqjoWTYksuxgDRmjMuMVQ%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-jdbc-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 9XfeSGdD6XIFv5aNLj7PpyPeaJwn2O8XJnrrFFGT04I%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-test-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: %2Fbjd2xB8%2Be%2BL%2B0m4FWcrZ3pYdy35Y2cK5tZJf4CLz%2BY%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-core-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: Cpq%2Bwv%2Fwmpl%2BjXpi84MhDo8l%2FynB9KcfmqdEHHsncOk%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-context-4.0.7.RELEASE
detailsRecommended version: 6.1.20
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: %2FcyrcoJmmpIUrMwt7%2BMILAOU5WqS6xu7qqnRpCCTl6M%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-jdbc-4.0.7.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: ey0BugOwRifEyb%2F2dXDG%2Bia1cC2RupnGvl49jcvMtIU%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-core-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: kljVA1xvD4QmJdwGnXo6IowRLCEiMRLCy37dsmINpWs%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-test-3.2.6.RELEASE
detailsRecommended version: 4.3.30-atlassian-fecru-1
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: lqwpNr%2FqUQ3YCFHthZxihw0cr1aPNixDl34STT6yfxQ%3D
Vulnerable Package
LOW CVE-2024-38820 Maven-org.springframework:spring-context-3.2.6.RELEASE
detailsRecommended version: 6.1.20
Description: The fix for CVE-2022-22968 made "disallowedFields" patterns in "DataBinder" case-insensitive. However, using "String.toLowerCase()" introduces some...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: nIegdysNlOBKrDyh6NqH3pswfIC%2F3E1WEUyZb6KG82Q%3D
Vulnerable Package
LOW CVE-2025-22233 Maven-org.springframework:spring-5.3.39
detailsDescription: CVE-2024-38820 ensured locale-independent, lowercase conversion for both the configured "disallowedFields" patterns and for request parameter names...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: EHlnjOOxy5l0G6dvqUwbhixWBDih6yZ0CSdf75zF178%3D
Vulnerable Package
LOW CVE-2025-22233 Maven-org.springframework:spring-context-4.0.7.RELEASE
detailsRecommended version: 6.1.20
Description: CVE-2024-38820 ensured locale-independent, lowercase conversion for both the configured "disallowedFields" patterns and for request parameter names...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: Kz3ubVJySLIuKgrz5fBKUaRhGgx%2B7CFnIyhDrJ5bops%3D
Vulnerable Package
LOW CVE-2025-22233 Maven-org.springframework:spring-context-3.2.6.RELEASE
detailsRecommended version: 6.1.20
Description: CVE-2024-38820 ensured locale-independent, lowercase conversion for both the configured "disallowedFields" patterns and for request parameter names...
Attack Vector: NETWORK
Attack Complexity: HIGH

ID: LIKVOBxUrh6jYw5Zakxq9OD2NDGRxlN%2BjhOlKAJNXb4%3D
Vulnerable Package
Fixed Issues (23)

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
HIGH CVE-2018-1272 Maven-org.springframework:spring-core-3.2.6.RELEASE
HIGH CVE-2018-1272 Maven-org.springframework:spring-core-4.0.7.RELEASE
HIGH Cx6a5f7948-7054 Maven-commons-collections:commons-collections-3.2.1
MEDIUM Absolute_Path_Traversal /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 138
MEDIUM Absolute_Path_Traversal /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 138
MEDIUM CVE-2022-22971 Maven-org.springframework:spring-core-3.2.6.RELEASE
MEDIUM CVE-2022-22971 Maven-org.springframework:spring-core-4.0.7.RELEASE
MEDIUM Hardcoded_password_in_Connection_String /jOOQ-scala/src/test/scala/org/jooq/scala/example/Test.scala: 55
MEDIUM Hardcoded_password_in_Connection_String /jOOQ-scala/src/test/scala/org/jooq/scala/test/MapperTest.scala: 61
MEDIUM Hardcoded_password_in_Connection_String /jOOQ-examples/jOOQ-groovy/src/org/jooq/groovy/GroovyTest.groovy: 11
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 138
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 183
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 138
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 183
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 138
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 183
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 138
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 183
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 138
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 138
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 183
LOW Log_Forging /jOOQ-codegen/src/main/java/org/jooq/util/GenerationTool.java: 183
LOW Use_Of_Hardcoded_Password_In_Config /jOOQ-examples/jOOQ-oracle-example/src/main/resources/config.properties: 5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jpeaks-eroad