GHSA-7fxc-486f-32q9 Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

• Maven org.springframework.hateoas:spring-hateoas: >= 3.0.0, < 3.0.4 → fixed in 3.0.4 • Maven org.springframework.hateoas:spring-hateoas: >= 2.5.0, < 2.5.3 → fixed in 2.5.3 • Maven org.springframework.hateoas:spring-hateoas: >= 2.3.0, <= 2.3.4 (no fix yet) • Maven org.springframework.hateoas:spring-hateoas: <= 1.5.6 (no fix yet) • Maven org.springframework.hateoas:spring-hateoas: >= 2.4.0, <= 2.4.1 (no fix yet)

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 3.0.0 through 3.0.3.