Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2015-5211 →
DEBIAN-CVE-2015-5211
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflecte...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
libspring-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]
Debian:13
libspring-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]
Debian:14
libspring-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-1"}]}]
Références
- advisory security-tracker.debian.org