CVE-2018-1257

⚪ Do wiadomości

W Spring Framework występuje podatność na atak DoS poprzez złośliwe wiadomości STOMP.

CVSS

6.5

EPSS

3.0%

Exploit

none

Vendor

oracle

Opis źródłowy (NVD)

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

dos Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	6.5
CISA KEV (aktywnie wykorzystywane)	Nie
FIRST EPSS (prawdopodobieństwo exploita)	3.0%
Opublikowano (NVD)	2018-05-11 20:29:00 UTC
Ostatnia modyfikacja (NVD)	2026-10-08 22:16:46 UTC

Referencje

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html ([email protected]) [Patch, Third Party Advisory]
http://www.securityfocus.com/bid/104260 ([email protected]) [Third Party Advisory, VDB Entry]
https://access.redhat.com/errata/RHSA-2018:1809 ([email protected]) [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2018:3768 ([email protected]) [Third Party Advisory]
https://pivotal.io/security/cve-2018-1257 ([email protected]) [Vendor Advisory]
https://www.oracle.com/security-alerts/cpujan2020.html ([email protected]) [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpujul2020.html ([email protected]) [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpuoct2021.html ([email protected]) [Patch, Third Party Advisory]
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html ([email protected]) [Patch, Third Party Advisory]
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html ([email protected]) [Patch, Third Party Advisory]
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html ([email protected]) [Patch, Third Party Advisory]