Описание
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
- io.micrometer:micrometer-core is on the classpath
- an ObservationRegistry is configured in the application to record observations Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.
Отчет
Red Hat Products are not affected by this vulnerability.
Меры по смягчению последствий
As a temporary workaround, Spring Boot 3.0.x and 3.1.x users can choose to disable web framework observations with the following property: management.metrics.enable.http.server.requests=false
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel for Spring Boot 3 | springframework | Not affected | ||
| Red Hat Data Grid 8 | springframework | Not affected | ||
| Red Hat Fuse 7 | springframework | Not affected | ||
| Red Hat JBoss Data Grid 7 | springframework | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | springframework | Not affected | ||
| streams for Apache Kafka | springframework | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * io.micrometer:micrometer-core is on the classpath * an ObservationRegistry is configured in the application to record observations Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * io.micrometer:micrometer-core is on the classpath * an ObservationRegistry is configured in the application to record observations Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user ...
Spring Framework vulnerable to denial of service
Уязвимость программной платформы Spring Framework, связанная с неограниченным распределением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3