https://bugzilla.redhat.com/show_bug.cgi?id=2087272
Bug ID: 2087272
Summary: CVE-2022-22970 springframework: DoS via data binding
to multipartFile or servlet part
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, chazlett(a)redhat.com,
dchen(a)redhat.com, drieden(a)redhat.com,
emingora(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
mnovotny(a)redhat.com, pdelbell(a)redhat.com,
pjindal(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported
versions, applications that handle file uploads are vulnerable to DoS attack if
they rely on data binding to set a MultipartFile or javax.servlet.Part to a
field in a model object.
Reference:
https://tanzu.vmware.com/security/cve-2022-22970
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2087272