CVE-2019-3797 Additional information exposure with Spring Data JPA derived queries
Attackers can retrieve excessive data via crafted query parameters in Spring Data JPA derived queries due to improper handling of LIKE wildcards.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-3797?
CVE-2019-3797 is a low-severity vulnerability in Spring Boot, published on 6 May 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Which versions are affected by CVE-2019-3797?
6 open source packages ship an affected version, including org.springframework.data:spring-data-jpa. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.data:spring-data-jpa Maven | All versions | 1.11.20 |
org.springframework.data:spring-data-jpa Maven | All versions | 1.11.20 |
org.springframework.data:spring-data-jpa Maven | From 2.0.0 | 2.0.14 |
org.springframework.data:spring-data-jpa Maven | From 2.0.0 | 2.0.14 |
org.springframework.data:spring-data-jpa Maven | From 2.1.0 | 2.1.6 |
org.springframework.data:spring-data-jpa Maven | From 2.1.0 | 2.1.6 |
Products include Pivotal Software Spring Data Java Persistence Api.
How do I fix CVE-2019-3797?
Upgrade org.springframework.data:spring-data-jpa to a fixed version for your release line: 1.11.20, 2.0.14 or 2.1.6.
Is CVE-2019-3797 being exploited?
There is no known exploitation of CVE-2019-3797 in the wild and no public exploit code.
Sources
Also known as GHSA-jgmr-wrwx-mgfj.