Bug 1564405 (CVE-2018-1270) - CVE-2018-1270 spring-framework: Possible RCE via spring messaging
Summary: CVE-2018-1270 spring-framework: Possible RCE via spring messaging
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1270
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1564409
Blocks: 1564411
TreeView+ depends on / blocked
 
Reported: 2018-04-06 07:57 UTC by Andrej Nemec
Modified: 2021-10-21 19:59 UTC (History)
82 users (show)

Fixed In Version: springframework 5.0.5, springframework 4.3.15
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-21 19:59:47 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2939 0 None None None 2018-10-17 19:29:42 UTC

Description Andrej Nemec 2018-04-06 07:57:28 UTC 
Spring Framework allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

External References:

https://pivotal.io/security/cve-2018-1270
Comment 1 Andrej Nemec 2018-04-06 08:04:02 UTC 
Created springframework tracking bugs for this issue:

Affects: fedora-all [bug 1564409]
Comment 4 Chess Hazlett 2018-04-10 17:16:27 UTC 
Upstream fix (5.0.5): https://github.com/spring-projects/spring-framework/commit/e0de9126ed8cf25cf141d3e66420da94e350708a
The fix in 4.3.15 was incomplete, and a new CVE issued: CVE-2018-1275.
Comment 9 Chess Hazlett 2018-04-16 18:27:26 UTC 
Statement:

No Red Hat products are directly affected by this flaw; the products that package some parts of the Spring Framework either do not ship the affected messaging component, or use an older version that is not affected. 

Fuse 6.3 and Fuse Integration Services 2.0 are both not directly affected by the flaw, but both point to the affected versions in their respective Camel-Springboot Maven repository BOMs. Fixes for those repository links will be addressed in advisories via regular patch cycle; customers using Spring stomp messaging from these Maven repositories are advised to update to the new BOMs when available.
Comment 10 errata-xmlrpc 2018-10-17 19:29:15 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8

Via RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939
Note You need to log in before you can comment on or make changes to this bug.