Описание
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true:
- The application evaluates user-supplied SpEL expressions.
A flaw was found in the Spring framework package. A maliciously crafted Spring Expression Language (SePL) may trigger uncontrolled CPU usage, leading to a denial of service in the application consuming it. To be considered vulnerable, one application has to evaluate user-supplied SpEL expressions.
Отчет
Moderate impact: CVE-2024-38808 affects certain Red Hat products containing the spring-expression component when an application evaluates user-supplied Spring Expression Language (SpEL) expressions. A maliciously crafted expression can cause uncontrolled CPU usage and denial of service. Red Hat's CVSS is 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), while CVE.org rates it 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L); the difference reflects Red Hat's assessment of high attack complexity and no required user interaction versus CVE.org's low complexity, required user interaction, and lower availability impact. The current affects data marks 18 product streams affected, 2 new, and 20 not affected. Affected scope includes Red Hat JBoss Fuse, OpenShift Developer Tools & Services, OpenShift Container Platform, Red Hat Build of Quarkus, Red Hat build of Apache Camel, Red Hat build of OptaPlanner, Red Hat Process Automation Manager, and cloud.redhat.com; Red Hat Enterprise Virtualization has a new entry. Red Hat AMQ, Enterprise Application Platform, JBoss Data Grid, Red Hat Build of Keycloak, Red Hat Single Sign-On, and some Red Hat build of Apache Camel streams are marked not affected; where recorded, the reason is that the vulnerable code is not present. Affected streams marked DELEGATED are handled through delegated product workflows; entries with delegated resolution AFFECTED remain subject to remediation through that workflow, while other delegated entries are explicitly marked DEFER, NOTAFFECTED, or WONTFIX. The cloud.redhat.com stream marked DEFER has no deferral reason recorded; residual risk remains denial of service wherever user-supplied SpEL is evaluated.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | spring-expression | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | org.springframework/spring-expression | Not affected | ||
| Red Hat AMQ Broker 7 | spring-expression | Not affected | ||
| Red Hat AMQ Clients | spring-expression | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-expression | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 3 | spring-expression | Out of support scope | ||
| Red Hat build of Apache Camel - HawtIO 4 | spring-expression | Fix deferred | ||
| Red Hat Build of Keycloak | spring-expression | Not affected | ||
| Red Hat build of OptaPlanner 8 | spring-expression | Will not fix | ||
| Red Hat build of Quarkus | spring-expression | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: * The application evaluates user-supplied SpEL expressions.
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported vers ...
Spring Framework vulnerable to Denial of Service
Уязвимость программной платформы Spring Framework, связанная с ошибками освобождения ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5.9 Medium
CVSS3