Bug 1408164 (CVE-2016-9878)
Summary: | CVE-2016-9878 Spring Framework: Directory Traversal in the Spring Framework ResourceServlet | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | abhgupta, aileenc, alazarot, aszczucz, avibelli, awels, bdawidow, bmcclain, chazlett, dandread, dmcphers, eedri, epp-bugs, etirelli, fnasser, gjospin, gsterlin, gvarsami, huwang, java-sig-commits, jbalunas, jcoleman, jialiu, jokerman, jolee, jpallich, jschatte, jshepherd, kverlaen, ldimaggi, lgao, lmeyer, lsurette, mbaluch, mgoldboi, michal.skrivanek, mmccomas, mweiler, mwinkler, myarboro, nthomas, nwallace, puntogil, rrajasek, rwagner, rzhang, sbonazzo, sisharma, soa-p-jira, srevivo, tcunning, theute, tiwillia, tkirby, twalsh, ykaul |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Spring Framework 3.2.18, Spring Framework 4.2.9, Spring Framework 4.3.5 | Doc Type: | If docs needed, set a value |
Doc Text: |
It was found that ResourceServlet in Spring Framework does not sanitize the paths that have been provided properly. An attacker can utilize this flaw to conduct a directory traversal attacks.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-21 11:48:58 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1408165 | ||
Bug Blocks: | 1408166 |
Description
Adam Mariš
2016-12-22 10:59:26 UTC
Created springframework tracking bugs for this issue: Affects: fedora-all [bug 1408165] Could not find any uses for ResourceServlet in Red Hat Mobile Application Platform. Marking as not affected. EAP 5 is in Extended Life Support phase, so we won't fix this moderate issue on that product. This issue has been addressed in the following products: Red Hat JBoss Fuse Via RHSA-2017:3115 https://access.redhat.com/errata/RHSA-2017:3115 |