Spring Framework allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Created springframework tracking bugs for this issue:
Affects: fedora-all [bug 1564409]
Upstream fix (5.0.5): https://github.com/spring-projects/spring-framework/commit/e0de9126ed8cf25cf141d3e66420da94e350708a
The fix in 4.3.15 was incomplete, and a new CVE issued: CVE-2018-1275.
No Red Hat products are directly affected by this flaw; the products that package some parts of the Spring Framework either do not ship the affected messaging component, or use an older version that is not affected.
Fuse 6.3 and Fuse Integration Services 2.0 are both not directly affected by the flaw, but both point to the affected versions in their respective Camel-Springboot Maven repository BOMs. Fixes for those repository links will be addressed in advisories via regular patch cycle; customers using Spring stomp messaging from these Maven repositories are advised to update to the new BOMs when available.
This issue has been addressed in the following products:
Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8
Via RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939