Spring · Spring Data Jpa · CVE-2019-3802
**Name of the Vulnerable Software and Affected Versions**
Spring Data JPA versions prior to 2.1.7
Spring Data JPA versions 2.0.x up to and including 2.0.14
Spring Data JPA versions 1.11.x up to and including 1.11.20
**Description**
The issue affects the ExampleMatcher in Spring Data JPA, where using `ExampleMatcher.StringMatcher.STARTING`, `ExampleMatcher.StringMatcher.ENDING`, or `ExampleMatcher.StringMatcher.CONTAINING` could return more results than anticipated when a maliciously crafted example value is supplied.
**Recommendations**
For Spring Data JPA versions prior to 2.1.7, update to version 2.1.7 or later.
For Spring Data JPA versions 2.0.x up to and including 2.0.14, update to version 2.0.15 or later.
For Spring Data JPA versions 1.11.x up to and including 1.11.20, update to version 1.11.21 or later.