Do now Restrict network access to Apache Vysper XML parsing endpoints and monitor memory use until a fix is released. Advisory
Health inspection
C
Java
1 ticket 86'd
Inspected live by pwned.coffee
What the inspector found
-
Apache Vysper Unbounded Allocation -
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi Do now Check Oracle's advisory for patched Java SE and GraalVM versions and apply them when available. Advisory -
In certain circumstances Spring Boot's default web security is ineffective allowing unaut Do now Add explicit Spring Security configuration to servlet apps instead of relying on Spring Boot defaults. Advisory -
Apache Tomcat Authentication bypass Do now Review WebSocket endpoint security constraints in Apache Tomcat and apply the fixed release when available. Advisory
How grades work
- FSomething is exploited and has no fix.
- DSomething is exploited, but a fix exists.
- CSomething has no fix yet, or three or more criticals are on the rail.
- BHigh or critical fixes are waiting to be carried.
- ANothing serious on the rail.
Put it on your README:
[](https://pwned.coffee/grade/java)