[GHSA-rrpm-pj7p-7j9q] Spring Security OAuth vulnerable to remote code execution (RCE)

[MarkLee131]

Updates

• References
• Source code location

Comments Add a patch https://github.com/spring-projects/spring-security-oauth/commit/1c6815ac1b26fb2f079adbe283c43a7fd0885f3, of which the commit message claims Remove SpelView in WhitelabelApprovalEndpoint Fixes gh-1340

Add a patch https://github.com/spring-projects/spring-security-oauth/commit/adb1e6d19c681f394c9513799b81b527b0cb007, of which the commit message claims Remove SpelView in WhitelabelApprovalEndpoint Fixes gh-1340

Add a patch https://github.com/spring-projects/spring-security-oauth/commit/8e9792c1963f1aeea81ca618785eb8d71d1cd1d, of which the commit message claims Remove SpelView in WhitelabelApprovalEndpoint Fixes gh-1340

"Add a patch https://github.com/spring-projects/spring-security-oauth/commit/6b1791179c1092553aa0690da22dac4dff2fc58, of which the commit message claims Remove SpelView in WhitelabelApprovalEndpoint Fixes gh-1340

[darakian]

Hey @MarkLee131, would you mind elaborating on how these fix commits are related to the advisory?

[taladrane]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.