← Releases

Micronaut Framework 5.2.4 Released!

We have released Micronaut Framework 5.2.4, a security release. The highlight of this release is Micronaut Control Panel 2.2.1, which fixes two high-severity vulnerabilities: GHSA-f9fp-ghwv-vgqq and GHSA-mfx7-wpg7-324q. We recommend that all users of Micronaut Control Panel update to Micronaut Framework 5.2.4.

The release also includes configuration fixes in Micronaut Core 5.2.20: property caches, config imports, environment refresh, and ${random.*} values.

The release includes:

What’s new in Micronaut Framework 5.2.4

Micronaut Core

Micronaut Core 5.2.20 includes the changes from Micronaut Core 5.2.18, 5.2.19, and 5.2.20, which are about configuration and the environment:

  • Property caches no longer hold a value that was read before a property source was added.
  • Placeholders in config import declarations are now resolved.
  • Environment refresh issues that remained after the earlier 5.2.16–5.2.18 refresh fixes are fixed.
  • ${random.*} values stay stable when a property source is processed.

Micronaut Data

Micronaut Data 5.2.4 escapes the generated ETag input columns.

Micronaut Serialization

Micronaut Serialization 3.2.6 uses the markers generated by Micronaut Sourcegen 2.2.4 for JaCoCo coverage.

Micronaut Sourcegen

Micronaut Sourcegen 2.2.4 automatically marks generated types with @GeneratedSource.

Micronaut Object Storage

Micronaut Object Storage 3.1.2 fixes a race when cleaning up the local snapshot directory.

Micronaut Control Panel

Micronaut Control Panel 2.2.1 fixes two vulnerabilities that affect Micronaut Control Panel 2.0.0 to 2.2.0.

GHSA-f9fp-ghwv-vgqq (CVSS 7.5) affects applications where the Control Panel is reachable without authentication. That is the default in the dev and test environments when Micronaut Security is absent, and whenever micronaut.control-panel.security.access=ANONYMOUS is set. An attacker with network access, or through DNS rebinding or a forged cross-site request from a web page, could run arbitrary SQL through the datasource panel, trigger other state-changing actions, and read the datasource password and database schema. Micronaut Control Panel 2.2.1:

  • requires same-origin requests and an X-Requested-With: micronaut-control-panel header on every state-changing request;
  • makes the datasource SQL console read-only by default. Set micronaut.control-panel.datasource.allow-writes=true to opt back in;
  • accepts unauthenticated requests only from loopback clients whose Host is on an allowlist (localhost, *.localhost, 127.0.0.1 and [::1], plus micronaut.control-panel.security.allowed-hosts);
  • masks datasource credentials;
  • serves the database schema as non-executable JSON.

GHSA-mfx7-wpg7-324q (CVSS 8.8) is an authorization bypass. A request was classified as a write by matching its raw path, but the router ignores a single trailing slash. A user with only read access could therefore reach the write endpoints by appending / to the path, and run arbitrary SQL or upload objects to the configured object stores. Micronaut Control Panel 2.2.1 normalizes the request path before it decides whether a request is a write.

The release also fixes the custom control panel guide examples and updates its dependencies.

If you haven’t yet updated to Micronaut Framework 5, this is an excellent opportunity to do so!

Please feel free to reach out to us if you need any assistance.