CVE-2018-15756 DoS Attack via Range Requests

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

PT-2018-2762

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch Description The issue is related to the implementation of the ResourceHttpRequestHandler class in...

CVE-2018-15756: Undefined Security Weakness

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controlle...

org.springframework:spring-hibernate (1.2.2), org.springframework:spring-mock (1.2.2) +3 more potentially affected by CVE-2015-3192 via org.springframework:spring-web (1.2.2)

org.springframework:spring-web MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.2 - org.springframework:spring-mock 1.2.2 -...

org.springframework:spring-hibernate (1.2.3), org.springframework:spring-mock (1.2.3) +3 more potentially affected by CVE-2015-3192 via org.springframework:spring-web (1.2.3)

org.springframework:spring-web MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.3 - org.springframework:spring-mock 1.2.3 -...

org.acegisecurity:acegi-security-cas (>=1.0.5, <=1.0.7), org.acegisecurity:acegi-security-samples-contacts (1.0.7) +4 more potentially affected by CVE-2015-3192 via org.springframework:spring-web (1.2.9)

org.springframework:spring-web MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security-cas =1.0.5, =1.0.7 -...

org.springframework:spring-hibernate (1.2.4), org.springframework:spring-mock (1.2.4) +3 more potentially affected by CVE-2015-3192 via org.springframework:spring-web (1.2.4)

org.springframework:spring-web MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-hibernate 1.2.4 - org.springframework:spring-mock 1.2.4 -...

org.springframework:spring-portlet (2.0-m1), org.springframework:spring-remoting (2.0-m1) +1 more potentially affected by CVE-2015-3192 via org.springframework:spring-web (2.0-m1)

org.springframework:spring-web MAVEN version 2.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0-m1 - org.springframework:spring-remoting 2.0-m1 -...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2015-3192 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

com.sun.jersey:jersey-spring (0.8-ea), org.springframework.ws:spring-ws-core (1.5.0) +5 more potentially affected by CVE-2015-3192 via org.springframework:spring-web (2.5.2)

org.springframework:spring-web MAVEN version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.sun.jersey:jersey-spring 0.8-ea - org.springframework.ws:spring-ws-core 1.5.0 -...

DoS Attack via Range Requests

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler , or starting in 5.0 when an annotated controll...

com.exadel.flamingo.maven.plugin:flamingoapp (>=1.0.0, <=1.5.0), org.acegisecurity:acegi-security (>=1.0.1, <=1.0.2) +19 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (1.2.7)

org.springframework:spring-webmvc MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.exadel.flamingo.maven.plugin:flamingoapp =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1,...

ar.com.jmfsg:api-doc (>=0.0.20, <=0.0.34), be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3) +1296 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (>=3.0.0.release, <=3.2.17.release)

org.springframework:spring-webmvc MAVEN version =3.0.0.release, =0.0.20, =0.3.3, =0.1.0, =1.0.0, =0.2, =3.0.1, =1.0.0-release, =3.0.10, =3.0.10, =4.2.1, =4.2.1, =4.2.1, =4.2.15 and more Source cves: CVE-2016-9878 Source advisory: GHSA-2M8H-FGR8-2Q9W...

ar.com.jmfsg:api-doc (>=0.0.20, <=0.0.34), be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3) +1296 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (>=3.0.0.release, <=3.2.17.release)

org.springframework:spring-webmvc MAVEN version =3.0.0.release, =0.0.20, =0.3.3, =0.1.0, =1.0.0, =0.2, =3.0.1, =1.0.0-release, =3.0.10, =3.0.10, =4.2.1, =4.2.1, =4.2.1, =4.2.15 and more Source cves: CVE-2016-9878 Source advisory: OSV:GHSA-2M8H-FGR8-2Q9W...

org.springframework.ws:spring-ws-core (1.0-m3) potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (2.0.2)

org.springframework:spring-webmvc MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework.ws:spring-ws-core 1.0-m3 Source cves: CVE-2016-9878 Source advisory:...

org.springmodules:spring-modules-jakarta-commons (>=0.8, <=0.8a), org.springmodules:spring-modules-osworkflow (>=0.8, <=0.8a) potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (2.0.3)

org.springframework:spring-webmvc MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons =0.8, =0.8, =0.8a Source cves: CVE-2016-9878...

org.apache.portals.bridges:springmvc (1.0.4), org.apache.portals.jetspeed-2:j2-admin (>=2.1.3, <=2.1.4) +13 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (2.0.5)

org.springframework:spring-webmvc MAVEN version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.portals.bridges:springmvc 1.0.4 - org.apache.portals.jetspeed-2:j2-admin =2.1.3,...

org.apache.activemq:activemq-web (5.0.0), org.apache.activemq:activemq-web-console (5.0.0) +9 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (2.0.6)

org.springframework:spring-webmvc MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.activemq:activemq-web 5.0.0 - org.apache.activemq:activemq-web-console 5.0.0 -...

com.mysema.web:webmin (0.2.3), org.parancoe:parancoe (0.3.3) +11 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (2.0.7)

org.springframework:spring-webmvc MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.mysema.web:webmin 0.2.3 - org.parancoe:parancoe 0.3.3 - org.parancoe:parancoe-core 0.3.3 ...

net.jawr.extensions:jawr-spring-extension (3.6), net.jawr.tools:jawr-ant (1.6) +11 more potentially affected by CVE-2016-9878 via org.springframework:spring-webmvc (2.0.8)

org.springframework:spring-webmvc MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.jawr.extensions:jawr-spring-extension 3.6 - net.jawr.tools:jawr-ant 1.6 -...