NetSight
IP …
critical9.8

CVE-2020-5413

Code execution in Spring Integration

Impact

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.springframework.integration:spring-integration-core>= 4.3.0, < 4.3.234.3.23

Affected products

VendorProductAffected versions
VmwareSpring Integration
from 4.3.0 through 4.3.22
from 5.1.0 through 5.1.11
from 5.2.0 through 5.2.7
from 5.3.0 through 5.3.1
OracleBanking Corporate Lending Process Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleBanking Credit Facilities Process Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleBanking Supply Chain Finance
Versions 14.2.0, 14.3.0, 14.5.0
OracleBanking Virtual Account Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleFlexcube Private Banking
Versions 12.0.0, 12.1.0
OracleRetail Customer Management And Segmentation Foundation
from 16.0 through 19.0
OracleRetail Merchandising System
Version 16.0.3

Weakness classification

CWE-502

References