| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.vault:spring-vault-core | ≥ 3.0.0, < 3.0.2< 2.3.3 | 3.0.22.3.3 |
| spring cloud config | ≥ 3.1.0, ≤ 3.1.6≥ 4.0.0, ≤ 4.0.1 | |
| spring cloud vault | = 4.0.0≥ 3.1.0, ≤ 3.1.2 | |
| spring vault | ≥ 2.3.0, < 2.3.3≥ 3.0.0, < 3.0.2 | 2.3.33.0.2 |
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free