Threats affecting pkg:maven/io.awspring/spring-cloud-aws

Spring Cloud AWS versions from 3.0.0 up to 4.0.1 did not verify the signature of incoming SNS messages on HTTP/HTTPS endpoints using specific notification mapping annotations. This allowed an unauthenticated attacker who knows the endpoint URL to send crafted HTTP POST requests mimicking SNS Notification or SubscriptionConfirmation messages. The vulnerability is fixed in version 4.0.2.