https://bugzilla.redhat.com/show_bug.cgi?id=2055480
Bug ID: 2055480 Summary: CVE-2021-22060 springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: jwon@redhat.com CC: aboyko@redhat.com, ahenning@redhat.com, aileenc@redhat.com, alazarot@redhat.com, anstephe@redhat.com, chazlett@redhat.com, dchen@redhat.com, drieden@redhat.com, emingora@redhat.com, etirelli@redhat.com, extras-orphan@fedoraproject.org, ggaughan@redhat.com, gmalinko@redhat.com, ibek@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jochrist@redhat.com, jolee@redhat.com, jrokos@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, krathod@redhat.com, kverlaen@redhat.com, lsurette@redhat.com, michal.skrivanek@redhat.com, mnovotny@redhat.com, mperina@redhat.com, pdelbell@redhat.com, pjindal@redhat.com, pskopek@redhat.com, puntogil@libero.it, rguimara@redhat.com, rrajasek@redhat.com, sbonazzo@redhat.com, sguilhen@redhat.com, tzimanyi@redhat.com Blocks: 2044407 Target Milestone: --- Classification: Other
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
https://nvd.nist.gov/vuln/detail/CVE-2021-22060 https://tanzu.vmware.com/security/cve-2021-22060
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
Avinash Hanwate ahanwate@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2062988
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2062988 [Bug 2062988] CVE-2021-22060 springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
--- Comment #4 from Avinash Hanwate ahanwate@redhat.com --- Created springframework tracking bugs for this issue:
Affects: fedora-all [bug 2062988]
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.11
Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5532
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
--- Comment #8 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2021-22060
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2022-07-07 19:10:03
https://bugzilla.redhat.com/show_bug.cgi?id=2055480 Bug 2055480 depends on bug 2062988, which changed state.
Bug 2062988 Summary: CVE-2021-22060 springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2062988
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
Red Hat Bugzilla bugzilla@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Doc Type|If docs needed, set a value |No Doc Update
java-sig-commits@lists.fedoraproject.org