GHSA-vpr3-f594-mg5g Improper Control of Generation of Code ('Code Injection') in Spring Framework

• Maven org.springframework:spring: >= 2.5.0, < 2.5.7 → fixed in 2.5.7 • Maven org.springframework:spring: >= 3.0.0, < 3.0.3 → fixed in 3.0.3

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing `class.classLoader.URLs[0]=jar:` followed by a URL of a crafted .jar file.