org.springframework.integration:spring-integration-syslog vulnerabilities (TuxCare)
15 vulnerabilities.
-
org.springframework.integration:spring-integration-syslogTuxCare fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction 8.2 High -
org.springframework.integration:spring-integration-syslogTuxCare EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders 6.3 Medium -
org.springframework.integration:spring-integration-syslogTuxCare Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check 4.2 Medium -
org.springframework.integration:spring-integration-syslogTuxCare Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation 6.8 Medium -
org.springframework.integration:spring-integration-syslogTuxCare Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference 8.0 High -
org.springframework.integration:spring-integration-syslogTuxCare SMB minimum protocol dialect defaults to SMB1 6.6 Medium -
org.springframework.integration:spring-integration-syslogTuxCare World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) 3.2 Low -
org.springframework.integration:spring-integration-syslogTuxCare Unbounded decompression in UnZipTransformer enables zip-bomb DoS 6.5 Medium -
org.springframework.integration:spring-integration-syslogTuxCare DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names 5.4 Medium -
org.springframework.integration:spring-integration-syslogTuxCare Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution 6.4 Medium -
org.springframework.integration:spring-integration-syslogTuxCare UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false 6.3 Medium -
org.springframework.integration:spring-integration-syslogTuxCare ZipTransformer uses file_name header to build workDirectory path without sanitization 5.4 Medium -
org.springframework.integration:spring-integration-syslogTuxCare Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS 5.4 Medium -
org.springframework.integration:spring-integration-syslogTuxCare JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list 6.3 Medium -
org.springframework.integration:spring-integration-syslogTuxCare Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization 7.1 High