Bug 1480608 – CVE-2017-9787 struts: Denial of service when using a Spring AOP functionality

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1480608 - (CVE-2017-9787) CVE-2017-9787 struts: Denial of service when using a Spring AOP functionality

Summary:	CVE-2017-9787 struts: Denial of service when using a Spring AOP functionality

Status:	NEW

Aliases:	CVE-2017-9787

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20170811,reported=2...
Keywords:	Security

Depends On:	1480611 1480610
Blocks:
	Show dependency tree / graph

Reported:	2017-08-11 09:36 EDT by Pedro Sampaio
Modified:	2018-01-30 10:46 EST (History)
CC List:	16 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Pedro Sampaio 2017-08-11 09:36:21 EDT

A flaw was found in Apache Struts 2.3.7 through 2.3.32 and 2.5 through 2.5.10.1. When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack even if user was not properly authenticated but an application mixed secured and not secured actions in one class.

References:

http://struts.apache.org/docs/s2-049.html
https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d@%3Cannouncements.struts.apache.org%3E

Comment 1 Pedro Sampaio 2017-08-11 09:36:48 EDT

Created struts tracking bugs for this issue:

Affects: epel-7 [bug 1480611]
Affects: fedora-all [bug 1480610]

Note You need to log in before you can comment on or make changes to this bug.