Release 3.7 vulnerabilities list
Critical
CVE | libs | Components | Resolution | Comments | |
|---|---|---|---|---|---|
| 1 | CVE-2016-1000027 | Spring 5.3.25, 5.3.33 | Shibboleth Websec, AdService Dmz | Not affected. | Shibboleth doesn’t use Java deserialization in any API endpoints https://www.tenable.com/security/research/tra-2016-20 This is not accepted as security issue on Spring codebase, rather an insecure setup using Java deserialization from untrusted sources. The final resolution: Verridium doesn’t use Java serialization on any API endpoints and therefore isn’t affected. Resolution: upgrade spring to 6.0.0 up |