This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-1257 →

DEBIAN-CVE-2018-1257

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP ov...

Original description

The description as published by the source.

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libspring-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-1"}]}]

Debian:13 libspring-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-1"}]}]

Debian:14 libspring-java

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-1"}]}]

References

advisory security-tracker.debian.org