GitHub Advisoryadvisory · Maven

GHSA-6v7w-535j-rq5m Pivotal Spring Framework DoS Attack with XML Input

MEDIUM Published 2018-10-17 Modified 2024-03-05 Official page ↗
Aliases
CVE-2015-3192
Ecosystem
Maven
Packages
org.springframework:spring-web
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-119
Reviewed
2020-06-16

Affected packages

• Maven org.springframework:spring-web: < 3.2.14 → fixed in 3.2.14 • Maven org.springframework:spring-web: >= 4.0.0, < 4.1.7 → fixed in 4.1.7 • Maven org.springframework:spring-web: >= 5.0.0.RC2, < 5.0.0.RC3 → fixed in 5.0.0.RC3

Description

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

Related

Alias · CVE (1)

  • CVE-2015-3192 Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References