PT-2024-7296

🗓️ 14 Aug 2024 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbu.gs👁 22 Views

DoS in parsing ETags from If-Match and If-None-Match in spring-web; upgrade to fixed versions.

Reporter	Title	Published	Views	Family All 504
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is uses spring-web-6.0.21.jar which is vulnerable to denial of service	12 Nov 202405:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 1.14.4 IF001	14 May 202420:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with OpenJDK, commons-compress and spring-web-5.3.27/spring-web-5.3.32 affect IBM Cloud Object Storage Systems (April 2024v1)	1 Apr 202416:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance - Identity Manager has multiple vulnerabilities	11 Jul 202407:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Sep 2024 - Multiple CVEs addressed	4 Oct 202406:44	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Framework affects IBM SPSS Collaboration and Deployment Services [CVE-2016-1000027]	22 Nov 202404:04	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of VMWare Tanzu Spring Framework, IBM DevOps Build is vulnerable to remote attacker to conduct phising attacks	3 Feb 202522:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for May 2024 - Multiple CVEs addressed	14 Jun 202409:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to a denial of service in VMware Tanzu Spring [CVE-2024-38809]	1 May 202519:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	6 Jun 202414:36	–	ibm

Source	Link
spring	www.spring.io/security/cve-2024-22262
security	www.security.netapp.com/advisory/ntap-20240920-0003
osv	www.osv.dev/vulnerability/CVE-2024-38809
github	www.github.com/spring-projects/spring-framework/commit/8d16a50907c11f7e6b407d878a26e84eba08a533
github	www.github.com/spring-projects/spring-framework/issues/33372
github	www.github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-38809
vuldb	www.vuldb.com/
spring	www.spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now

12 Oct 2026 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 46.9

CVSS 3.18.1

EPSS0.02573

SSVC

denial of service etag parsing if match header if none match header spring web upgrades required