Pivotal Spring

Lgtm security researchers discovered a critical vulnerability (CVE-2017-8046) affecting various projects in Pivotal Spring, a framework used to build web applications. If exploited, this vulnerability could allow a remote threat actor to execute arbitrary code on any system running an application built using Spring Data REST. Researchers liken this vulnerability to CVE-2017-5638 that affected Apache Struts and led to the Equifax data breach. This vulnerability impacts Spring Data REST components, versions prior to 2.5.12, 2.6.7, and 3.0RC3, as well as Spring Boot versions prior to 2.0.0M4, and Spring Data versions prior to Kay-RC3. The NJCCIC recommends all developers using affected Spring products and components review the lgtm blog and update to the latest versions as soon as possible.