CVE-2019-3802

Name of the Vulnerable Software and Affected Versions Spring Data JPA versions prior to 2.1.7 Spring Data JPA versions 2.0.x up to and including 2.0.14 Spring Data JPA versions 1.11.x up to and including 1.11.20

Description The issue affects the ExampleMatcher in Spring Data JPA, where using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING, or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.

Recommendations For Spring Data JPA versions prior to 2.1.7, update to version 2.1.7 or later. For Spring Data JPA versions 2.0.x up to and including 2.0.14, update to version 2.0.15 or later. For Spring Data JPA versions 1.11.x up to and including 1.11.20, update to version 1.11.21 or later.