Описание
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written.
This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
A flaw was found in Spring Security. When applications using Spring Security specify HTTP response headers for servlet applications, these headers may not be written. This can lead to a bypass of security policies or information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data or compromise the integrity of the application.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Fix deferred | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel8 | Fix deferred | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel9 | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 4 | spring-security-core | Fix deferred | ||
| Red Hat build of Apache Camel - HawtIO 4 | spring-security-core | Fix deferred | ||
| Red Hat build of Quarkus | quarkus-spring-security-core-api | Fix deferred | ||
| Red Hat Data Grid 8 | spring-security-core | Fix deferred | ||
| Red Hat Fuse 7 | org.apache.servicemix.bundles.spring-security-core | Fix deferred | ||
| Red Hat Fuse 7 | spring-security-core | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 7 | spring-security-core | Fix deferred |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security: from 5.7.0 through 5.7.21, from 5.8.0 through 5.8.23, from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.8, from 7.0.0 through 7.0.3.
When applications specify HTTP response headers for servlet applicatio ...
Spring Security HTTP Headers Are not Written Under Some Conditions
Уязвимость Java-фреймворка для обеспечения безопасности промышленных приложений Spring Security, связанная с использованием небезопасной прямой ссылкой на объект, позволяющая нарушителю выполнить произвольный код
6.5 Medium
CVSS3