https://bugzilla.redhat.com/show_bug.cgi?id=1540030
Bug ID: 1540030
Summary: CVE-2017-8030 spring-framework: Improper URL path
validation allows for bypassing of security checks on
static resources
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
chazlett(a)redhat.com, chrisw(a)redhat.com,
dchen(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jolee(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lhh(a)redhat.com, lpeer(a)redhat.com, lpetrovi(a)redhat.com,
markmc(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, nwallace(a)redhat.com,
nyechiel(a)redhat.com, paradhya(a)redhat.com,
pavelp(a)redhat.com, pszubiak(a)redhat.com,
puntogil(a)libero.it, rbryant(a)redhat.com,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sclewis(a)redhat.com, sdaley(a)redhat.com,
sisharma(a)redhat.com, slinaber(a)redhat.com,
tcunning(a)redhat.com, tdecacqu(a)redhat.com,
tkirby(a)redhat.com, vhalbert(a)redhat.com
Spring Framework and Spring Security do not consider URL path parameters when
processing security constraints. By adding a URL path parameter with special
encodings, an attacker may be able to bypass a security constraint and access
Spring MVC static resource URLs.
Affected versions include:
* Spring Security 4.1.0 - 4.1.4, 4.2.0 - 4.2.3 and 5.0
* Spring Framework 4.3.0 - 4.3.14, and 5.0.0 - 5.0.2
Older unmaintained versions of Spring Security and Spring Framework may also be
affected.
Upstream Advisory:
https://pivotal.io/security/cve-2017-8030
--
You are receiving this mail because:
You are on the CC list for the bug.