OSV-2023-1001

    Dashboard / Vulnerabilities / OSV-2023-1001

    OSV-2023-1001

    Published: 11 Oct 2023Last Modified: 14 Oct 2023

    Summary: Security exception in java.base/java.lang.String.repeat

    Details: OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63154 ``` Crash type: Security exception Crash state: java.base/java.lang.String.repeat org.springframework.expression.spel.ast.OpMultiply.getValueInternal org.springframework.expression.spel.ast.MethodReference.getArguments ```

    References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63154

    Affected packages

    Package

    Name: spring-data-keyvalue

    Purl: pkg:generic/spring-data-keyvalue

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0d4a18fc90cf134d33a227bea68b6e2d9cad7541
    Fixed -ee43ad3b43ee470a617c568522edf07f606b1516

    Affected versions

    3.0.0
    3.0.1
    3.0.10
    3.0.2
    3.0.3
    3.0.4
    3.0.5
    3.0.6
    3.0.7
    3.0.8
    3.0.9
    3.0.11

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OSV-2023-1001 | CVE-DB