Spring Framework server Web Observations DoS Vulnerability
Résumé
Spring Framework server Web Observations DoS Vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Specifically, an application is vulnerable when all of the following are true:
- the application uses Spring MVC or Spring WebFlux
- io.micrometer:micrometer-core is on the classpath
- an ObservationRegistry is configured in the application to record observations
Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Ubuntu UBUNTU-CVE-2023-34053 libspring-java
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- web spring.io