https://bugzilla.redhat.com/show_bug.cgi?id=1565926
Bug ID: 1565926
Summary: CVE-2018-1274 spring-data-commons: Unlimite path
depths in PropertyPath.java allow remote attackers to
cause a denial of service
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: dffrench(a)redhat.com, drusso(a)redhat.com,
hghasemb(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmadigan(a)redhat.com, jshepherd(a)redhat.com,
lgriffin(a)redhat.com, ngough(a)redhat.com,
puntogil(a)libero.it, pwright(a)redhat.com,
rrajasek(a)redhat.com, tjay(a)redhat.com,
trepel(a)redhat.com
Blocks: 1565924
Spring Data Commons, versions 1.13 to 1.13.10 and 2.0 to 2.0.5, contain a
property path parser vulnerability caused by unlimited resource allocation. An
unauthenticated remote malicious user (or attacker) can issue requests against
Spring Data REST endpoints or endpoints using property path parsing which can
cause a denial of service (CPU and memory consumption).
External References:
https://pivotal.io/security/cve-2018-1274
Upstream Issue:
https://jira.spring.io/browse/DATACMNS-1285
Upstream Patches:
https://github.com/spring-projects/spring-data-commons/commit/371f6590c50...
https://github.com/spring-projects/spring-data-commons/commit/3d8576fe4e4...
--
You are receiving this mail because:
You are on the CC list for the bug.