Bug 2259703 (CVE-2024-22233)

Summary:	CVE-2024-22233 spring-boot: Crafted HTTP requests may lead to debial-of-service (DOS)
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adupliak, aileenc, anstephe, aschwart, asoldano, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, brian.stansberry, chazlett, chfoley, cmiranda, cmoulliard, darran.lofthouse, dbruscin, dhanak, dkreling, dosoudil, drichtar, drosa, fmariani, gmalinko, gtanzill, ibek, istudens, ivassile, iweiss, janstey, jkoops, jpoth, jrokos, kaycoth, kvanderr, kverlaen, lthon, mnovotny, mosmerov, mposolda, msochure, mstefank, msvehla, mulliken, nwallace, pberan, pbizzarr, pcongius, pdelbell, pdrozd, peholase, pesilva, pgallagh, pjindal, pmackay, porcelli, pskopek, rguimara, rkieley, rmartinc, rowaters, rruss, rstancel, rstepani, saroy, sausingh, smaestri, ssilvert, sthorger, swoodman, tcunning, tom.jenkinson, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Spring Framework. This issue may allow a remote user to provide specially crafted HTTP requests, leading the application to a Denial of Service (DoS). An application may be considered vulnerable if it meets the both conditions: The application uses Spring MVC and Spring Security versions 6.1.6, 6.2.1, or above are set on the classpath.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2259706
Bug Blocks:	2259704

Description Marco Benatto 2024-01-22 20:58:56 UTC

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

  *  the application uses Spring MVC
  *  Spring Security 6.1.6+ or 6.2.1+ is on the classpath


Typically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.

Comment 1 Patrick Del Bello 2024-01-22 21:07:43 UTC

Created log4j tracking bugs for this issue:

Affects: fedora-all [bug 2259706]

Comment 4 Vipul Nair 2024-01-30 13:21:04 UTC

Those versions are respectively being used by Spring Boot 3.1.7 and 3.2.1. are the ones that are affected.