https://bugzilla.redhat.com/show_bug.cgi?id=2055480
Bug ID: 2055480
Summary: CVE-2021-22060 springframework: Additional Log
Injection in Spring Framework (follow-up to
CVE-2021-22096)
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: jwon(a)redhat.com
CC: aboyko(a)redhat.com, ahenning(a)redhat.com,
aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, chazlett(a)redhat.com,
dchen(a)redhat.com, drieden(a)redhat.com,
emingora(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
lsurette(a)redhat.com, michal.skrivanek(a)redhat.com,
mnovotny(a)redhat.com, mperina(a)redhat.com,
pdelbell(a)redhat.com, pjindal(a)redhat.com,
pskopek(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
sbonazzo(a)redhat.com, sguilhen(a)redhat.com,
tzimanyi(a)redhat.com
Blocks: 2044407
Target Milestone: ---
Classification: Other
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older
unsupported versions, it is possible for a user to provide malicious input to
cause the insertion of additional log entries. This is a follow-up to
CVE-2021-22096 that protects against additional types of input and in more
places of the Spring Framework codebase.
https://nvd.nist.gov/vuln/detail/CVE-2021-22060
https://tanzu.vmware.com/security/cve-2021-22060
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2055480