From adf108ed87cfbe666a56cd9cab986afc3854150e Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 27 Jun 2024 16:36:34 +0000
Subject: [PATCH] Publish GHSA-jjfh-589g-3hjx

---
 .../GHSA-jjfh-589g-3hjx.json                  | 24 ++++++++++++++-----
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/advisories/github-reviewed/2023/11/GHSA-jjfh-589g-3hjx/GHSA-jjfh-589g-3hjx.json b/advisories/github-reviewed/2023/11/GHSA-jjfh-589g-3hjx/GHSA-jjfh-589g-3hjx.json
index c0c40f3e89e..485fbf31fa6 100644
--- a/advisories/github-reviewed/2023/11/GHSA-jjfh-589g-3hjx/GHSA-jjfh-589g-3hjx.json
+++ b/advisories/github-reviewed/2023/11/GHSA-jjfh-589g-3hjx/GHSA-jjfh-589g-3hjx.json
@@ -1,24 +1,28 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jjfh-589g-3hjx",
-  "modified": "2023-12-22T00:30:31Z",
+  "modified": "2024-06-27T16:35:04Z",
   "published": "2023-11-28T09:30:27Z",
   "aliases": [
     "CVE-2023-34055"
   ],
-  "summary": "Spring Boot denial of service vulnerability",
-  "details": "In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  the application uses Spring MVC or Spring WebFlux\n  *  org.springframework.boot:spring-boot-actuator is on the classpath",
+  "summary": "Spring Boot Actuator denial of service vulnerability",
+  "details": "In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n  *  the application uses Spring MVC or Spring WebFlux\n  *  `org.springframework.boot:spring-boot-actuator` is on the classpath",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
     }
   ],
   "affected": [
     {
       "package": {
         "ecosystem": "Maven",
-        "name": "org.springframework.boot:spring-boot"
+        "name": "org.springframework.boot:spring-boot-actuator"
       },
       "ranges": [
         {
@@ -37,7 +41,7 @@
     {
       "package": {
         "ecosystem": "Maven",
-        "name": "org.springframework.boot:spring-boot"
+        "name": "org.springframework.boot:spring-boot-actuator"
       },
       "ranges": [
         {
@@ -56,7 +60,7 @@
     {
       "package": {
         "ecosystem": "Maven",
-        "name": "org.springframework.boot:spring-boot"
+        "name": "org.springframework.boot:spring-boot-actuator"
       },
       "ranges": [
         {
@@ -78,6 +82,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34055"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/spring-projects/spring-boot/commit/5490e73922b37a7f0bdde43eb318cb1038b45d60"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/spring-projects/spring-boot"
@@ -86,6 +94,10 @@
       "type": "WEB",
       "url": "https://security.netapp.com/advisory/ntap-20231221-0010"
     },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-6226862"
+    },
     {
       "type": "WEB",
       "url": "https://spring.io/security/cve-2023-34055"