Security Bulletin: Public disclosed vulnerability from Spring Framework affects IBM Spectrum LSF Application Center

Summary

Public disclosed vulnerability from Spring Framework affects IBM Spectrum LSF Application Center

Vulnerability Details

**CVE-ID:**CVE-2018-15756 Description: Pivotal Spring Framework is vulnerable to a denial of service, caused by improper handling of range request by the ResourceHttpRequestHandler. By adding a range header with a high number of ranges, a remote attacker could exploit this vulnerability to cause a denial of service condition.

CVSS Base Score: 7.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/151641&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Spectrum LSF Application Center 10.2, 10.2.0.6, 10.2.0.7

Remediation/Fixes

<Product

|

VRMF

|

APAR

|

Remediation/First Fix

—|—|—|—

Spectrum LSF Application Center

|

10.2

|

None

|

See workaround

Spectrum LSF Application Center

|

10.2.0.6

|

None

|

See workaround

Spectrum LSF Application Center

|

10.2.0.7

|

None

|

See workaround

Workarounds and Mitigations

Spectrum LSF Application Center 10.2 & 10.2.0.6 & 10.2.0.7

1. Download Spring Framework 4.3.22 from following link, https://repo.spring.io/release/org/springframework/spring/4.3.22.RELEASE/spring-framework-4.3.22.RELEASE-dist.zip
2. Replace the downloaded files (spring-context-support-4.3.22.RELEASE.jar, spring-beans-4.3.22.RELEASE.jar, spring-context-4.3.22.RELEASE.jar, spring-expression-4.3.22.RELEASE.jar, spring-web-4.3.22.RELEASE.jar, spring-core-4.3.22.RELEASE.jar, spring-aop-4.3.22.RELEASE.jar, spring-context-support-4.3.22.RELEASE.jar, spring-jdbc-4.3.22.RELEASE.jar, spring-beans-4.3.22.RELEASE.jar, spring-context-4.3.22.RELEASE.jar, spring-expression-4.3.22.RELEASE.jar, spring-web-4.3.22.RELEASE.jar, spring-core-4.3.22.RELEASE.jar, spring-webmvc-4.3.22.RELEASE.jar, spring-aop-4.3.22.RELEASE.jar, spring-orm-4.3.22.RELEASE.jar, spring-tx-4.3.22.RELEASE.jar) into Application Center installed environment.
3. How to find replace files location
   * Navigate to Spectrum LSF Application Center installed directory
   * run command ‘find . -name “spring4.3.2*.jar”’