CVE-2024-38807
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Spring Boot
- Vendor
- Spring
- Product
- Spring Boot
- Platforms
- Unknown
- Default status
unaffected- Package
- Spring Boot
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.7.x | affected | enterprise support only | 2.7.22 | Unavailable | None listed |
| 3.0.x | affected | enterprise support only | 3.0.17 | Unavailable | None listed |
| 3.1.x | affected | enterprise support only | 3.1.13 | Unavailable | None listed |
| 3.2.x | affected | OSS | 3.2.9 | Unavailable | None listed |
| 3.3.x | affected | OSS | 3.3.3 | Unavailable | None listed |