Check your Spring Security SAML config - XXE security issue

Engineering | Rob Winch | August 24, 2016 | ...

It was brought to our attention that the spring-security-saml sample application contained an XML External Entity (XXE) vulnerability. This meant that a malicious user could view any file that the Spring Application’s process had access to.

The issue was a direct result of OpenSAML Java ParserPool and Decrypter Vulnerable To XML Attacks. The default behavior of the ParserPool implementations is fixed in OpenSAML 2.6.1+ (which Spring Security SAML uses). However, the vulnerability is still possible if users construct their own ParserPool without the proper settings.

Note

We did not consider this a CVE because the exploit was only found in the sample application which is not considered production code. However, we expect that our users may have copied this code to create their own applications. For this reason, we wanted to be transparent and communicate the issue and…

This Week in Spring - August 23, 2016

Engineering | Josh Long | August 23, 2016 | ...

Welcome to another installation of This Week in Spring! This week I'm in NYC (for the NYC Java SIG), Austin and San Francisco (for the Silicon Valley Spring User Group) talking to customers and doing meetups! We've got a lot to cover, as usual, so let's get to it!

Spring Cloud Spinnaker 1.0.0.M1

Engineering | Greg L. Turnquist | August 19, 2016 | ...

Greetings Spring community,

I am happy to release the first milestone for Spring Cloud Spinnaker. Spring Cloud Spinnaker bundles up the continuous delivery Spinnaker platform, and provides a 1-click installer to let you install it to any certified Cloud Foundry provider.

At this year’s SpringOne Platform 2016 conference, there were two talks about Spinnaker. If you have early release access and missed them, you can watch right now. Otherwise you can catch them on the SpringDeveloper YouTube Channel once they are published.

If your team/meetup/JUG is interested in hearing more about Spinnaker, check in with me and we can arrange a…

This Week in Spring - August 16th, 2016

Engineering | Josh Long | August 16, 2016 | ...

Welcome to another installment of This Week in Spring! Since we last spoke I've presented at conferences and to customers in London, Beijing, Shanghai and Singapore - where I am now. Tomorrow, Wednesday, I'll be speaking at the Singapore Spring Meetup - join me! It's been quite a few days!

Managing your Database Secrets with Vault

Engineering | Mark Paluch | August 15, 2016 | ...

In my previous post about Managing Secrets with Vault, I introduced you to Vault and how to store arbitrary secrets using the generic secret backend. Vault can manage more than just secret data like API keys, passwords, and other sensitive string-like data. Today we’re taking a look at Vault’s integration with databases, services, and certificates.

Database credentials tend to be static

When it comes to databases, the regular workflow of getting credentials applying for a database is asking some operator or a self-service tool to give you credentials so your application can log into the…

This Week in Spring - August 9th, 2016

Engineering | Josh Long | August 09, 2016 | ...

Welcome to another installment of This Week in Spring! This week I'm recovering from a crazy awesome week at SpringOne Platform while visiting customers here in summer-time London.

We've got a lot to cover so let's get to it!

and day 2 and the posts on Pivotal's main blog for day 1, day 2, day 3, and final call

This Week in Spring - SpringOne Platform 2016 edition! - August 2nd, 2016

Engineering | Josh Long | August 03, 2016 | ...

Welcome to another very special installment of This Week in Spring - this week Pivotal is out in force at SpringOne Platform 2016. This year saw more people, more topics and more sponsors than ever! For more, check out our SpringOne Platform recap blog!

If you're not here, then fear not all the talks will be available online, but until then.. wish you were here! As with previous years, the race to SpringOne was filled with awesome releases that should keep you more than busy while you wait for the talks to be available online as replays! Let's get to it!

  • Spring Boot co-lead Phillip Webb announced Spring Boot 1.4, just in time for SpringOne Platform!
  • ..and Spring Boot ninja Stephane Nicoll announced Spring Boot 1.3.7
  • Spring Data ninja Mark Paluch announced Spring Data Ingalls M1, packed with lots of new features (and 250 tickets fixed!) include for property access in conversion subsystem (Commons, MongoDB), an update to Cassandra 3.0 for Spring Data Cassandra,

SpringOne Platform 2016 Recap: Day 1

Engineering | Josh Long | August 02, 2016 | ...

by Josh Long and Pieter Humphrey

Spring's central to a key message: software is business differentiating functionality, and everything that defers an organization's from delivering better software, faster and safer, should be automated or eliminated. SpringOne Platform captures that narrative with talks on all things continuous delivery.

The SpringOne Platform 2016 event shows how everything about this show has been bigger and better than ever! We've doubled the conference attendance from 2015, with record (2000+) attendees, 200+ talks, 30+ sponsors, amazing speakers from Netflix, Paypal…

Spring IO Platform Athens RC1

Engineering | Andy Wilkinson | July 29, 2016 | ...

It's my pleasure to announce that Spring IO Platform Athens-RC1 is available now from the Spring milestone repository.

This release is the first to adopt a new alphabetical versioning scheme similar to those already used by Spring Cloud and Spring Data. The theme for the Platform's versions is world cities.

The Athens release upgrades the versions of a number of projects:

  • Spring Framework 4.3
  • Spring AMQP 1.6
  • Spring Boot 1.4
  • Spring Data Hopper
  • Spring Hateoas 0.20
  • Spring Integration 4.3
  • Spring LDAP 2.1
  • Spring REST Docs 1.1
  • Spring Security 4.1
  • Spring Session 1.2
  • Spring Web Services 2.3

The…

Reactive Programming with Spring 5.0 M1

Engineering | Rossen Stoyanchev | July 28, 2016 | ...

As Juergen mentioned in his Spring Framework 5 M1 release announcement our Spring Reactive initiative has been merged into Spring Framework proper preserving all contributions and its full history over more than a year.

What is it?

In a nutshell reactive programming is about non-blocking, event-driven applications that scale with a small number of threads with backpressure as a key ingredient that aims to ensure producers do not overwhelm consumers. The Reactive Streams specification (also adopted in Java 9) enables the ability to communicate demand across layers and libraries from different…

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all