Bug 1591931 (CVE-2018-11040) - CVE-2018-11040 springframework: cross-domain requests via JSONP through AbstractJsonpResponseBodyAdvice
Summary: CVE-2018-11040 springframework: cross-domain requests via JSONP through Abstr...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-11040
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1591933 1648712 1648714 1648716 1648718 1648719
Blocks: 1639954
TreeView+ depends on / blocked
 
Reported: 2018-06-15 19:36 UTC by Laura Pardo
Modified: 2021-02-17 00:07 UTC (History)
57 users (show)

Fixed In Version: springframework 5.0.7, springframework 4.3.18
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-07-12 13:05:39 UTC
Embargoed:


Attachments (Terms of Use)

Description Laura Pardo 2018-06-15 19:36:05 UTC
Spring Framework, versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers, and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot. However when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.


References:
https://pivotal.io/security/cve-2018-11040

Comment 1 Laura Pardo 2018-06-15 19:36:44 UTC
Created springframework tracking bugs for this issue:

Affects: fedora-all [bug 1591933]

Comment 5 Doran Moppert 2018-11-13 00:25:47 UTC
Mitigation:

According to the upstream advisory, this vulnerability only applies to applications that do all of the following:

 * Explicitly configure MappingJackson2JsonView.
 * Do not set the jsonpParameterNames property of MappingJackson2JsonView to an empty set.
 * Expose sensitive user information over endpoints that can render content with JSONP.

Comment 8 Doran Moppert 2018-11-16 05:44:33 UTC
Statement:

From an OpenDaylight perspective, whilst the shipped versions of Open Dayight ship artifacts which fall within the affected versions ("older unsupported versions"), this flaw only has impact when JSONP is used in certain circumstances. Given the libraries themselves are not used in a vulnerable way, being only used as part of tests, no package update to mitigate this flaw for Open Daylight is required.

The package rhevm-dependencies does not include the spring-webmvc component, where this vulnerability exists.

Comment 9 Joshua Padman 2019-05-15 22:56:22 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse Service Works 6
 * Red Hat JBoss BRMS 5
 * Red Hat JBoss Data Virtualization & Services 6
 * Red Hat JBoss SOA Platform 5

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 10 Joshua Padman 2019-06-07 03:43:55 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 11 Joshua Padman 2019-06-07 03:56:54 UTC
The vulnerability exist in org.springframework.web which is not a dependency of Fuse 7. Marked as not affected.

Comment 12 Product Security DevOps Team 2019-07-12 13:05:39 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-11040


Note You need to log in before you can comment on or make changes to this bug.