3 ms·

Not sure about the veracity of this, but: https://twitter.com/AlBaker_Dev/status/292415396684918784 https://twitter.com/AlBaker_Dev/status/292415396684918784

• moondowner 14y ago
  It's valid. Here's more info: http://support.springsource.com/security/cve-2011-2730 http://support.springsource.com/security/cve-2011-2730 And here's an overview for all Spring modules: http://support.springsource.com/security/springsource-all http://support.springsource.com/security/springsource-all
• andrewcooke 14y ago
  3.0.6 and 2.5.6SEC03 require explicit configuration to fix this - they are not safe by default. 3.1 is safe without config. see http://www.h-online.com/open/news/item/The-ghost-of-a-Spring-Framework-bug-haunts-old-code-1786850.html http://www.h-online.com/open/news/item/The-ghost-of-a-Spring...