Bug 2251920 (CVE-2023-34053) - CVE-2023-34053 springframework: io.micrometer:micrometer-core classpath vulnerable to denial of service
Summary: CVE-2023-34053 springframework: io.micrometer:micrometer-core classpath vulne...
Keywords:
Status: NEW
Alias: CVE-2023-34053
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2251921
TreeView+ depends on / blocked
 
Reported: 2023-11-28 12:40 UTC by Pedro Sampaio
Modified: 2024-05-17 14:56 UTC (History)
35 users (show)

Fixed In Version: springframework 6.0.14
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2023-11-28 12:40:20 UTC 
In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

Specifically, an application is vulnerable when all of the following are true:

  *  the application uses Spring MVC or Spring WebFlux
  *  io.micrometer:micrometer-core is on the classpath
  *  an ObservationRegistry is configured in the application to record observations


Typically, Spring Boot applications need the org.springframework.boot:spring-boot-actuator dependency to meet all conditions.

https://spring.io/security/cve-2023-34053
Note You need to log in before you can comment on or make changes to this bug.