Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2024-38807

CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Boot

Default version status: unaffected

  • 2.7.x to < 2.7.22affected
  • 3.0.x to < 3.0.17affected
  • 3.1.x to < 3.1.13affected
  • 3.2.x to < 3.2.9affected
  • 3.3.x to < 3.3.3affected

References