Bug 2269846 (CVE-2024-22259)

Summary: CVE-2024-22259 springframework: URL Parsing with Host Validation
Product: [Other] Security Response Reporter: Avinash Hanwate <ahanwate>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: adupliak, aileenc, anstephe, asoldano, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, brian.stansberry, cdewolf, chazlett, chfoley, cmiranda, cmoulliard, darran.lofthouse, dhanak, dkreling, dosoudil, dpalmer, drichtar, ecerquei, fjuma, fmariani, gmalinko, ibek, ikanello, ivassile, iweiss, janstey, jpoth, jrokos, jross, jscholz, kverlaen, lgao, lthon, mnovotny, mosmerov, msochure, mstefank, msvehla, mulliken, nwallace, parichar, pcongius, pdelbell, pdrozd, peholase, pgallagh, pjindal, pmackay, pskopek, rguimara, rkieley, rowaters, rruss, rstancel, saroy, smaestri, sthorger, swoodman, tasato, tcunning, tom.jenkinson, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: springframework 6.1.5, springframework 6.0.18, springframework 5.3.33 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Spring Framework. Affected versions of this package are vulnerable to an Open Redirect when using UriComponentsBuilder to parse an externally provided URL and perform validation checks on the host of the parsed URL.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2269852    

Description Avinash Hanwate 2024-03-16 18:09:25 UTC 
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as  CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

https://spring.io/security/cve-2024-22259
Comment 3 errata-xmlrpc 2024-05-21 14:18:56 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss AMQ

Via RHSA-2024:2945 https://access.redhat.com/errata/RHSA-2024:2945