https://bugzilla.redhat.com/show_bug.cgi?id=1643043
Bug ID: 1643043
Summary: CVE-2018-15756 springframework: DoS Attack via Range
Requests
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
bmcclain(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, dblechte(a)redhat.com,
dfediuck(a)redhat.com, dingyichen(a)gmail.com,
drieden(a)redhat.com, eedri(a)redhat.com,
etirelli(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jstastny(a)redhat.com,
kbasil(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lhh(a)redhat.com, lpeer(a)redhat.com, lpetrovi(a)redhat.com,
lsurette(a)redhat.com, markmc(a)redhat.com,
mburns(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pszubiak(a)redhat.com,
puntogil(a)libero.it, ratamir(a)redhat.com,
rbryant(a)redhat.com, Rhev-m-bugs(a)redhat.com,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sbonazzo(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, sherold(a)redhat.com,
sisharma(a)redhat.com, slinaber(a)redhat.com,
smohan(a)redhat.com, ssaha(a)redhat.com,
tcunning(a)redhat.com, tdecacqu(a)redhat.com,
tkirby(a)redhat.com, vbellur(a)redhat.com,
vhalbert(a)redhat.com, ylavi(a)redhat.com
Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x
prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide
support for range requests when serving static resources through the
ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller
returns an org.springframework.core.io.Resource. A malicious user (or attacker)
can add a range header with a high number of ranges, or with wide ranges that
overlap, or both, for a denial of service attack.
--
You are receiving this mail because:
You are on the CC list for the bug.