CVE-2023-20861: Medium severity IBM Watson Knowledge Catalog on-prem vulnerability

Q: What is CVE-2023-20861?

CVE-2023-20861 is a vulnerability found in Spring Framework that allows a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Q: How can a malicious user exploit this vulnerability?

A malicious user can exploit this vulnerability by providing a specially crafted SpEL expression.

Q: What is the severity of CVE-2023-20861?

The severity of CVE-2023-20861 is medium, with a severity value of 5.3.

Q: How can I fix CVE-2023-20861?

To fix CVE-2023-20861, update to Spring Framework versions 6.0.7, 5.3.26, or apply the recommended patches provided by your vendor.

Published Mar 20, 2023

Updated

A flaw found was found in Spring Framework. This flaw allows a malicious user to use a specially crafted SpEL expression that causes a denial of service (DoS).

Other sources

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

VMware Tanzu Spring Framework is vulnerable to a denial of service. By sending a specially crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service.

— IBM

Affected Software

12 affected componentsFixes available

redhat/jenkins<0:2.401.1.1686649641-3.el8

0:2.401.1.1686649641-3.el8

redhat/jenkins<0:2.401.1.1686680404-3.el8

0:2.401.1.1686680404-3.el8

redhat/ovirt-dependencies<0:4.5.3-1.el8e

0:4.5.3-1.el8e

redhat/springframework<6.0.7

6.0.7

redhat/springframework<5.3.26

5.3.26

IBM Watson Knowledge Catalog on-prem<=4.x

maven/org.springframework:spring-expression<5.2.23.RELEASE

5.2.23.RELEASE

maven/org.springframework:spring-expression>=5.3.0<5.3.26

5.3.26

maven/org.springframework:spring-expression>=6.0.0<6.0.7

6.0.7

VMware Spring Framework<=5.2.22

VMware Spring Framework>=5.3.0<=5.3.25

VMware Spring Framework>=6.0.0<=6.0.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.401.1.1686649641-3.el8
Upgrade
Upgrade redhat/jenkins to a version that resolves this vulnerability.
Fixed in 0:2.401.1.1686680404-3.el8
Upgrade
Upgrade redhat/ovirt-dependencies to a version that resolves this vulnerability.
Fixed in 0:4.5.3-1.el8e
Upgrade
Upgrade redhat/springframework to a version that resolves this vulnerability.
Fixed in 6.0.7
Upgrade
Upgrade redhat/springframework to a version that resolves this vulnerability.
Fixed in 5.3.26
Upgrade
Upgrade maven/org.springframework:spring-expression to a version that resolves this vulnerability.
Fixed in 5.2.23.RELEASE
Upgrade
Upgrade maven/org.springframework:spring-expression to a version that resolves this vulnerability.
Fixed in 5.3.26
Upgrade
Upgrade maven/org.springframework:spring-expression to a version that resolves this vulnerability.
Fixed in 6.0.7

Event History

Mar 20, 2023

CVE Published

12:00 AM

Mar 23, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Advisory Published

via GitHub·09:30 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2023-20861?

CVE-2023-20861 is a vulnerability found in Spring Framework that allows a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

Which versions of Spring Framework are affected?

Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions are affected.

How can a malicious user exploit this vulnerability?