{"id":"CVE-2020-5413","details":"Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the \"deserialization gadgets\" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown \"deserialization gadgets\" when configuring Kryo in code.","aliases":["GHSA-86qr-9vqc-pgc6"],"modified":"2026-09-20T03:45:05.436590850Z","published":"2020-07-31T20:15:13.017Z","database_specific":{"unresolved_ranges":[{"source":"CPE_RANGE","vendor_product":"oracle:retail_customer_management_and_segmentation_foundation","cpes":["cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.0"},{"last_affected":"19.0"}]},{"extracted_events":[{"introduced":"14.2.0"},{"last_affected":"14.2.0"},{"introduced":"14.3.0"},{"last_affected":"14.3.0"},{"introduced":"14.5.0"},{"last_affected":"14.5.0"}],"source":"CPE_STRING","vendor_product":"oracle:banking_corporate_lending_process_management","cpes":["cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"oracle:banking_credit_facilities_process_management","cpes":["cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.2.0"},{"last_affected":"14.2.0"},{"introduced":"14.3.0"},{"last_affected":"14.3.0"},{"introduced":"14.5.0"},{"last_affected":"14.5.0"}]},{"cpes":["cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.2.0"},{"last_affected":"14.2.0"},{"introduced":"14.3.0"},{"last_affected":"14.3.0"},{"introduced":"14.5.0"},{"last_affected":"14.5.0"}],"source":"CPE_STRING","vendor_product":"oracle:banking_supply_chain_finance"},{"cpes":["cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.2.0"},{"last_affected":"14.2.0"},{"introduced":"14.3.0"},{"last_affected":"14.3.0"},{"introduced":"14.5.0"},{"last_affected":"14.5.0"}],"source":"CPE_STRING","vendor_product":"oracle:banking_virtual_account_management"},{"cpes":["cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.0.0"},{"last_affected":"12.0.0"},{"introduced":"12.1.0"},{"last_affected":"12.1.0"}],"source":"CPE_STRING","vendor_product":"oracle:flexcube_private_banking"},{"vendor_product":"oracle:retail_merchandising_system","cpes":["cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.0.3"},{"last_affected":"16.0.3"}],"source":"CPE_STRING"}]},"references":[{"type":"ADVISORY","url":"https://tanzu.vmware.com/security/cve-2020-5413"},{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-integration","events":[{"introduced":"fff9743bdcb47db734f2c1a843ada201dac4d1b9"},{"last_affected":"b272c34d63cc4e571750fc2004ec2db3cf0afce4"},{"introduced":"3c4529e6cd3feb731f060f4822e9682b9244cfea"},{"last_affected":"cbfcb939cd8d2025cc6002eb7b0fe56cd543b5ca"},{"introduced":"c9d68c5c5555b73e8294f0702ab87b84abaa9733"},{"last_affected":"1a2593059044b939b91401e3d356e5689e9f4d05"},{"introduced":"8fd0f068543f64253f1e495e7b1c8b17f2506194"},{"last_affected":"08316577cea0be542559b6510d7ef5e0d9c87aa7"}],"database_specific":{"extracted_events":[{"introduced":"4.3.0"},{"last_affected":"4.3.22"},{"introduced":"5.1.0"},{"last_affected":"5.1.11"},{"introduced":"5.2.0"},{"last_affected":"5.2.7"},{"introduced":"5.3.0"},{"last_affected":"5.3.1"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*"}}],"versions":["v5.3.1.RELEASE","v5.2.7.RELEASE","v5.1.11.RELEASE","v5.3.0.RELEASE","v5.2.6.RELEASE","v5.1.10.RELEASE","v5.2.5.RELEASE","v4.3.22.RELEASE","v5.2.4.RELEASE","v5.2.3.RELEASE","v5.2.2.RELEASE","v5.2.1.RELEASE","v5.1.9.RELEASE","v5.2.0.RELEASE","v5.1.8.RELEASE","v5.1.7.RELEASE","v4.3.21.RELEASE","v5.1.6.RELEASE","v5.1.5.RELEASE","v4.3.20.RELEASE","v5.1.4.RELEASE","v5.1.3.RELEASE","v5.1.2.RELEASE","v4.3.19.RELEASE","v5.1.1.RELEASE","v4.3.18.RELEASE","v5.1.0.RELEASE","v4.3.17.RELEASE","v4.3.16.RELEASE","v4.3.15.RELEASE","v4.3.14.RELEASE","v4.3.13.RELEASE","v4.3.12.RELEASE","v4.3.11.RELEASE","v4.3.10.RELEASE","v4.3.9.RELEASE","v4.3.8.RELEASE","v4.3.7.RELEASE","v4.3.6.RELEASE","v4.3.5.RELEASE","v4.3.4.RELEASE","v4.3.3.RELEASE","v4.3.2.RELEASE","v4.3.1.RELEASE","v4.3.0.RELEASE"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5413.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}