Spring Boot Loader Vulnerability: Signature Forgery Attack
CVE-2024-38807

6.3MEDIUM

Key Information:

Vendor

Spring

Status
Spring Boot
Vendor
CVE Published:
23 August 2024

What is CVE-2024-38807?

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Spring Boot 2.7.x < 2.7.22

Spring Boot 3.0.x < 3.0.17

Spring Boot 3.1.x < 3.1.13

References

https://spring.io/security/cve-2024-38807

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.