https://bugzilla.redhat.com/show_bug.cgi?id=2034584
Bug ID: 2034584
Summary: CVE-2021-22096 springframework: malicious input leads
to insertion of additional log entries
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: aboyko(a)redhat.com, ahenning(a)redhat.com,
aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, chazlett(a)redhat.com,
dchen(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
hvyas(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
lef(a)fedoraproject.org, lsurette(a)redhat.com,
michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com,
mperina(a)redhat.com, pdelbell(a)redhat.com,
pjindal(a)redhat.com, pskopek(a)redhat.com,
puntogil(a)libero.it, rrajasek(a)redhat.com,
sbonazzo(a)redhat.com, sguilhen(a)redhat.com,
tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older
unsupported versions, it is possible for a user to provide malicious input to
cause the insertion of additional log entries.
References:
https://tanzu.vmware.com/security/cve-2021-22096
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2034584