Denial of Service in Spring Cloud Function

2022-06-2200:00:54

Google

osv.dev

0.001 Low

EPSS

Percentile

38.5%

JSON

In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.

CPENameOperatorVersion
org.springframework.cloud:spring-cloud-function-parenteq3.2.1
org.springframework.cloud:spring-cloud-function-parenteq3.0.13.RELEASE
org.springframework.cloud:spring-cloud-function-parenteq3.0.7.RELEASE
org.springframework.cloud:spring-cloud-function-parenteq3.0.8.RELEASE
org.springframework.cloud:spring-cloud-function-parenteq3.0.9.RELEASE
org.springframework.cloud:spring-cloud-function-parenteq2.0.1.RELEASE
org.springframework.cloud:spring-cloud-function-parenteq2.1.0.RELEASE
org.springframework.cloud:spring-cloud-function-parenteq3.2.2
org.springframework.cloud:spring-cloud-function-parenteq3.1.0
org.springframework.cloud:spring-cloud-function-parenteq1.0.1.RELEASE

Name	Operator	Version
org.springframework.cloud:spring-cloud-function-parent	eq	3.2.1
org.springframework.cloud:spring-cloud-function-parent	eq	3.0.13.RELEASE
org.springframework.cloud:spring-cloud-function-parent	eq	3.0.7.RELEASE
org.springframework.cloud:spring-cloud-function-parent	eq	3.0.8.RELEASE
org.springframework.cloud:spring-cloud-function-parent	eq	3.0.9.RELEASE
org.springframework.cloud:spring-cloud-function-parent	eq	2.0.1.RELEASE
org.springframework.cloud:spring-cloud-function-parent	eq	2.1.0.RELEASE
org.springframework.cloud:spring-cloud-function-parent	eq	3.2.2
org.springframework.cloud:spring-cloud-function-parent	eq	3.1.0
org.springframework.cloud:spring-cloud-function-parent	eq	1.0.1.RELEASE