Bug 1584376 – CVE-2018-1260 spring-security-oauth: remote code execution in the authorization process

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1584376 - (CVE-2018-1260) CVE-2018-1260 spring-security-oauth: remote code execution in the authorization process

Summary:	CVE-2018-1260 spring-security-oauth: remote code execution in the authorizati...

Status:	NEW

Aliases:	CVE-2018-1260

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20180509,repo...
Keywords:	Security

Depends On:
Blocks:	1584382
	Show dependency tree / graph

Reported:	2018-05-30 14:47 EDT by Laura Pardo
Modified:	2018-10-22 07:13 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:	spring-security-oauth 2.3.3, spring-security-oauth 2.2.2, spring-security-oauth 2.1.2, spring-security-oauth 2.0.15
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2018:1809	None	None	None	2018-06-07 04:26 EDT
Red Hat Product Errata	RHSA-2018:2939	None	None	None	2018-10-17 15:30 EDT

Groups: None (edit)

Description Laura Pardo 2018-05-30 14:47:57 EDT

A flaw was found in Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.


References:
https://pivotal.io/security/cve-2018-1260

Comment 2 claprun@redhat.com 2018-06-01 04:41:46 EDT

Shouldn't this be marked as critical as that's how the Pivotal CVE is classified?

Comment 3 errata-xmlrpc 2018-06-07 04:26:08 EDT

This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes (text-only advisories)

Via RHSA-2018:1809 https://access.redhat.com/errata/RHSA-2018:1809

Comment 4 errata-xmlrpc 2018-10-17 15:30:01 EDT

This issue has been addressed in the following products:

  Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8

Via RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939

Comment 5 marthasimons2 2018-10-22 07:13:00 EDT

Thanka for greate job Red Hat Fuse Intergration Services 2.0

Via RHSA-2018:2940 https://goo.gl/hKpzJK

Note You need to log in before you can comment on or make changes to this bug.