|
Vulnerabilities
< Back

CVE-2024-38807

Updated on 23 Aug 2024

Severity

6.3 Medium severity

Details

CVSS score
6.3
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

Details

Affected product:
Spring
Affected packages:
spring-boot-buildpack-platform @ 3.1.8 (+306 more)
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

Fixes