Описание
When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Ссылки
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 4.0.0 (включая) до 4.0.6 (исключая)
cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
EPSS
Процентиль: 3%
0.00136
Низкий
5 Medium
CVSS3
6.8 Medium
CVSS3
Дефекты
CWE-295
Связанные уязвимости
CVSS3: 4.2
redhat
4 месяца назад
When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
CVSS3: 5
github
4 месяца назад
Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.
EPSS
Процентиль: 3%
0.00136
Низкий
5 Medium
CVSS3
6.8 Medium
CVSS3
Дефекты
CWE-295