はてなブックマーク

CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+ A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. Howev

Updates [04-13] "Data Binding Rules Vulnerability CVE-2022-22968" follow-up blog post published, related to the "disallowedFields" from the Suggested Workarounds [04-08] Snyk announces an additional attack vector for Glassfish and Payara. See also related Payara, upcoming release announcement [04-04] Updated Am I Impacted with improved description for deployment requirements [04-01] Updated Am I I

Engineering | Eleftheria Stein-Kousathana | February 21, 2022 | ... In Spring Security 5.7.0-M2 we deprecated the WebSecurityConfigurerAdapter, as we encourage users to move towards a component-based security configuration. To assist with the transition to this new style of configuration, we have compiled a list of common use-cases and the suggested alternatives going forward. In the examples belo

Updates: Since this blog post has been published, a new logback 1.2.9 version has been published. While this fixes a security issue, prerequisites for exploits are very different as they "requires write access to logback's configuration file". Log4J also released a new 2.17.0 version with fixes for CVE-2021-45046 and CVE-2021-45105. Spring Boot 2.5.8 and 2.6.2 haven been released and provide depen

As announced at SpringOne yesterday, Spring Framework 6 and Spring Boot 3 are planned towards a high-end baseline for their general availability in Q4 2022: Java 17+ (from Java 8-17 in the Spring Framework 5.3.x line) Jakarta EE 9+ (from Java EE 7-8 in the Spring Framework 5.3.x line) This forward-looking baseline will provide significant benefits in our API design and integration efforts, shining

Today, after one year and half of work, I am pleased to announce that we’re launching the beta release of Spring Native and its availability on start.spring.io! In practice, that means that in addition to the regular Java Virtual Machine supported by Spring since its inception, we are adding beta support for compiling Spring applications to native images with GraalVM in order to provide a new way

Spring Batch on Kubernetes: Efficient batch processing at scale Introduction Batch processing has been a challenging area of computer science since its inception in the early days of punch cards and magnetic tapes. Nowadays, the modern cloud computing era comes with a whole new set of challenges for how to develop and operate batch workload efficiently in a cloud environment. In this blog post, I

Spring Boot 2.4.0.M2 has just been released, and it brings with it some interesting changes to the way that application.properties and application.yml files are loaded. If your applications use the fairly typical setup of only using a single application.properties or application.yml file, then you’ll probably not notice any difference. If, however, you have applications that use more complex setup

We made a fairly significant change to Spring Boot in 2.3.0.M1. It was the first release of the project to be built with Gradle rather than Maven. A thread on Twitter about the migration had a number of people asking why we switched and the benefits, if any, that we’d seen. This blog post aims to answer those questions. Each project in the Spring portfolio is run in a fairly autonomous manner. We

Going Reactive with Spring, Coroutines and Kotlin Flow Since we announced Spring Framework official support for Kotlin in January 2017, a lot of things happened. Kotlin was announced as an official Android development language at Google I/O 2017, we continued to improve the Kotlin support across Spring portfolio and Kotlin itself has continued to evolve with key new features like coroutines. I wou

Spring Boot 2.3.0.M1 has just been released and it brings with it some interesting new features that can help you package up your Spring Boot application into Docker images. In this blog post we’ll take a look at the typical ways developers create Docker images, and show how they can be improved by using these new features. Common Docker Techniques Although it’s always been possible to convert the

On behalf of the Spring Boot team and everyone that has contributed, I am delighted to announce that Spring Boot 2.2.0 has been released and is available now from repo.spring.io, Maven Central and Bintray. This release adds a significant number of new features and improvements. For full upgrade instructions and new and noteworthy features please see the release notes. What's new in 2.2 Dependency

The JVM can be a complex beast. Thankfully, much of that complexity is under the hood, and we as application developers and deployers often don't have to worry about it too much. With the rise of container-based deployment strategies, one area of complexity that needs some attention is the JVM's memory footprint. Two kinds of memory The JVM divides its memory into two main categories: heap memory

Many people use containers to wrap their Spring Boot applications, and building containers is not a simple thing to do. This is a guide for developers of Spring Boot applications, and containers are not always a good abstraction for developers. They force you to learn about and think about low-level concerns. However, you may on occasion be called on to create or use a container, so it pays to und

Performance has always been one of the top priorities of the Spring Engineering team, and we are continually monitoring and responding to changes and to feedback. Some fairly intense and precise work has been done recently (in the last 2-3 years) and this article is here to help you to find the results of that work and to learn how to measure and improve performance in your own applications. The h

Many people are using containers to wrap their Spring Boot applications, and building containers is not a simple thing to do. This is an article for developers of Spring Boot applications, and containers are not always a good abstraction for developers - they force you to learn about and think about very low level concerns - but you will on occasion be called on to create or use a container, so it

This tutorial shows you how to build efficiently a sample blog application by combining the power of Spring Boot and Kotlin. If you are starting with Kotlin, you can learn the language by reading the reference documentation, following the online Kotlin Koans tutorial or just using Spring Framework reference documentation which now provides code samples in Kotlin. Spring Kotlin support is documente

Micrometer: Spring Boot 2's new application metrics collector Table of Contents What is it? What do I get out of the box? Which monitoring systems does Micrometer support? The distinction between metrics and tracing The importance of dimensionality Meter filters Why the /actuator/metrics endpoint changed in Spring Boot 2 Get involved What is it? Micrometer is a dimensional-first metrics collection

On behalf of the team, it is my very great pleasure to announce that Spring Boot 2.0 is now generally available as 2.0.0.RELEASE from repo.spring.io and Maven Central! This release is the culmination of 17 months work and over 6800 commits by 215 different individuals. A massive thank you to everyone that has contributed, and to all the early adopters that have been providing vital feedback on the

Copyright © 2005 - 2024 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. Terms of Use • Privacy • Trademark Guidelines • Your California Privacy Rights Apache®, Apache Tomcat®, Apache Kafka®, Apache Cassandra™, and Apache Geode™ are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. J

This guide walks you through the process of creating a Spring application and then testing it with JUnit. You will build a simple Spring application and test it with JUnit. You probably already know how to write and run unit tests of the individual classes in your application, so, for this guide, we will concentrate on using Spring Test and Spring Boot features to test the interactions between Spr

On behalf of the team, it is my great pleasure to announce that Spring Boot 2.0.0.RC1 has been released and is now available from our milestone repository. This release closes a massive 313 issues and pull requests, and is our first release candidate. At this point we're not anticipating that any major API changes or new features will be added before our final 2.0 GA release. We've refined a numbe

On behalf of the team, it is my pleasure to announce that Spring Boot 2.0.0.M7 has been released and is now available from our milestone repository. This release closes 165 issues and pull requests and continues our progress towards 2.0 GA. Thanks to everyone that has contributed! This release refines a number of items from previous milestones, and provides a number of notable new features: Condit

Hot on the heels of the latest Spring Framework 4.3 mainteance release, Spring Boot 1.5.9 is now available from repo.spring.io and Maven Central. Spring Boot 1.5.9 includes over 40 fixes, improvements and dependency updates. Thanks to all that have contributed with issue reports and pull requests. How can you help? If you're interested in helping out, check out the "ideal for contribution" tag in