Описание
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.
Users of affected versions should upgrade to the corresponding fixed version.
Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
A flaw was found in the Spring Web (org.springframework:spring-web) package. Due to improper ETag prefix validation when the application parses ETags from the If-Match or If-None-Match request headers, an attacker can trigger a denial of service by sending a maliciously crafted conditional HTTP request.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | spring-web | Will not fix | ||
| Red Hat AMQ Broker 7 | spring-web | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 3 | spring-web | Not affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | spring-web | Affected | ||
| Red Hat Build of Keycloak | spring-web | Not affected | ||
| Red Hat build of OptaPlanner 8 | spring-web | Will not fix | ||
| Red Hat Data Grid 8 | spring-web | Not affected | ||
| Red Hat Fuse 7 | spring-web | Out of support scope | ||
| Red Hat Integration Camel K 1 | spring-web | Not affected | ||
| Red Hat JBoss Data Grid 7 | spring-web | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
Applications that parse ETags from "If-Match" or "If-None-Match" reque ...
Spring Framework DoS via conditional HTTP request
Уязвимость программной платформы Spring Framework, связанная с ошибками освобождения ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5.3 Medium
CVSS3