https://bugzilla.redhat.com/show_bug.cgi?id=1800617
Bug ID: 1800617
Summary: CVE-2020-5397 springframework: CSRF attack via CORS
Preflight Requests with Spring MVC or Spring WebFlux
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, chazlett(a)redhat.com,
dblechte(a)redhat.com, dfediuck(a)redhat.com,
dingyichen(a)gmail.com, drieden(a)redhat.com,
eedri(a)redhat.com, esammons(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gvarsami(a)redhat.com,
hvyas(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jolee(a)redhat.com, jross(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
mcressma(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pjindal(a)redhat.com, puebele(a)redhat.com,
puntogil(a)libero.it, rrajasek(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
sbonazzo(a)redhat.com, sdaley(a)redhat.com,
sherold(a)redhat.com, sisharma(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
vbellur(a)redhat.com, vhalbert(a)redhat.com,
yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks
through CORS preflight requests that target Spring MVC (spring-webmvc module)
or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated
endpoints are vulnerable because preflight requests should not include
credentials and therefore requests should fail authentication. However a
notable exception to this are Chrome based browsers when using client
certificates for authentication since Chrome sends TLS client certificates in
CORS preflight requests in violation of spec requirements. No HTTP body can be
sent or received as a result of this attack.
Reference:
https://pivotal.io/security/cve-2020-5397
--
You are receiving this mail because:
You are on the CC list for the bug.