Bug 1564405 (CVE-2018-1270)

Summary:	CVE-2018-1270 spring-framework: Possible RCE via spring messaging
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	aileenc, alazarot, anstephe, apevec, bmaxwell, bmcclain, cdewolf, chazlett, chrisw, csutherl, darran.lofthouse, dffrench, dimitris, dosoudil, drieden, drusso, eedri, etirelli, gvarsami, gzaronik, ibek, java-sig-commits, jawilson, jclere, jcoleman, jjoyce, jmadigan, jolee, jondruse, jpadman, jschatte, jschluet, jshepherd, jstastny, kverlaen, ldimaggi, lef, lgao, lgriffin, lhh, lpeer, lsurette, markmc, mbabacek, mburns, mgoldboi, michal.skrivanek, mkolesni, myarboro, ngough, nwallace, oourfali, ppalaga, pslavice, psotirop, puntogil, pwright, rbryant, rnetuka, rrajasek, rstancel, rsvoboda, rsynek, rwagner, rzhang, sbonazzo, sclewis, sdaley, sherold, sisharma, slinaber, slong, tcunning, tdecacqu, tkirby, trepel, twalsh, vtunka, weli, yjog, ykaul, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	springframework 5.0.5, springframework 4.3.15	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 19:59:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1564409
Bug Blocks:	1564411

Description Andrej Nemec 2018-04-06 07:57:28 UTC

Spring Framework allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

External References:

https://pivotal.io/security/cve-2018-1270

Comment 1 Andrej Nemec 2018-04-06 08:04:02 UTC

Created springframework tracking bugs for this issue:

Affects: fedora-all [bug 1564409]

Comment 4 Chess Hazlett 2018-04-10 17:16:27 UTC

Upstream fix (5.0.5): https://github.com/spring-projects/spring-framework/commit/e0de9126ed8cf25cf141d3e66420da94e350708a
The fix in 4.3.15 was incomplete, and a new CVE issued: CVE-2018-1275.

Comment 9 Chess Hazlett 2018-04-16 18:27:26 UTC

Statement:

No Red Hat products are directly affected by this flaw; the products that package some parts of the Spring Framework either do not ship the affected messaging component, or use an older version that is not affected. 

Fuse 6.3 and Fuse Integration Services 2.0 are both not directly affected by the flaw, but both point to the affected versions in their respective Camel-Springboot Maven repository BOMs. Fixes for those repository links will be addressed in advisories via regular patch cycle; customers using Spring stomp messaging from these Maven repositories are advised to update to the new BOMs when available.

Comment 10 errata-xmlrpc 2018-10-17 19:29:15 UTC

This issue has been addressed in the following products:

  Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8

Via RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939