DoS Attack via Range Requests (Pivotal Spring framework)
En bref
- Source
- NVD
- EPSS
- EPSS 8.80 % · centile 95 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- dell
- Statut NVD
- Modified
Rechercher sur…
Description
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
Références
- http://www.securityfocus.com/bid/105703
- https://lists.apache.org/thread.html/a3071e11c6fbd593022074ec1b4693f6d948c2b02cfa4a5d854aed68%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/339fd112517e4873695b5115b96acdddbfc8f83b10598528d37c7d12%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/d6a84f52db89804b0ad965f3ea2b24bb880edee29107a1c5069cc3dd%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/bb354962cb51fff65740d5fb1bc2aac56af577c06244b57c36f98e4d%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/7b156ee50ba3ecce87b33c06bf7a749d84ffee55e69bfb5eca88fcc3%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/77886fec378ee6064debb1efb6b464a4a0173b2ff0d151ed86d3a228%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/8a1fe70534fc52ff5c9db5ac29c55657f802cbefd7e9d9850c7052bd%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/efaa52b0aa67aae7cbd9e6ef96945387e422d7ce0e65434570a37b1d%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/f8905507a2c94af6b08b72d7be0c4b8c6660e585f00abfafeccc86bc%40%3Cissues.activemq.apache.org%3E
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://pivotal.io/security/cve-2018-15756
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | dell |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · security_alert@emc.com (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-ffvq-7w96-97p7 — Denial of Service in Spring Framework
Références européennes
- ENISA EUVD · EUVD-2020-0486
- GCVE · GCVE-0-2018-15756
Avis du CERT-FR
- CERTFR-2020-AVI-037 — Multiples vulnérabilités dans Oracle Systems · cert.ssi.gouv.fr
- CERTFR-2019-AVI-341 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
- CERTFR-2019-AVI-331 — Vulnérabilité dans IBM QRadar · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.3.20cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.10cpe:2.3:a:vmware:spring_framework:5.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:11.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_online_mediation_controller:6.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_fusion_applications:13.3.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*≥ 8.0.2 ≤ 8.0.8cpe:2.3:a:oracle:flexcube_private_banking:12.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_private_banking:12.0.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:goldengate_application_adapters:12.3.2.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:healthcare_master_person_index:3.0:*:*:*:*:*:*:*- +74 autres
Produits affectés
| Produit | Versions |
|---|---|
| Pivotal · Spring framework | affected 5.1 ; affected 5.0.0 ≤ 5.0.9 ; affected 4.3 ≤ 4.3.19 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |