Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the “jsonp” and “callback” JSONP parameters, enabling cross-domain requests.
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
github.com/advisories/GHSA-f26x-pr96-vw86
github.com/spring-projects/spring-framework
github.com/spring-projects/spring-framework/commit/874859493bbda59739c38c7e52eb3625f247b93a
github.com/spring-projects/spring-framework/commit/b80c13b722bb207ddf43f53a007ee3ddc1dd2e26
lists.debian.org/debian-lts-announce/2021/04/msg00022.html
nvd.nist.gov/vuln/detail/CVE-2018-11040
pivotal.io/security/cve-2018-11040
www.oracle.com/security-alerts/cpujan2020.html
www.oracle.com/security-alerts/cpujul2020.html
www.oracle.com/security-alerts/cpuoct2021.html
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html