CVE-2023-20863: Input Validation
First published: Thu Apr 13 2023(Updated: )
A flaw was found in Spring Framework. Certain versions of Spring Framework's Expression Language were not restricting the size of Spring Expressions. This could allow an attacker to craft a malicious Spring Expression to cause a denial of service on the server.
Credit: security@vmware.com security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Spring Framework | >=5.2.0<5.2.24 | |
| VMware Spring Framework | >=5.3.0<5.3.27 | |
| VMware Spring Framework | >=6.0.0<6.0.8 | |
| redhat/spring framework | <6.0.8 | 6.0.8 |
| redhat/spring framework | <5.3.27 | 5.3.27 |
| redhat/spring framework | <5.2.24. | 5.2.24. |
| maven/org.springframework:spring-expression | <5.2.24.RELEASE | 5.2.24.RELEASE |
| maven/org.springframework:spring-expression | >=5.3.0<5.3.27 | 5.3.27 |
| maven/org.springframework:spring-expression | >=6.0.0<6.0.8 | 6.0.8 |
| IBM Cloud Pak for Business Automation | <=V22.0.2 - V22.0.2-IF004 | |
| IBM Cloud Pak for Business Automation | <=V21.0.3 - V21.0.3-IF020 | |
| IBM Cloud Pak for Business Automation | <=V22.0.1 - V22.0.1-IF006 and later fixesV21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2023-20863 https://nvd.nist.gov/vuln/detail/CVE-2023-20863 https://spring.io/security/cve-2023-20863
- https://bugzilla.redhat.com/show_bug.cgi?id=2187742
- https://access.redhat.com/errata/RHSA-2023:2099
- https://access.redhat.com/errata/RHSA-2023:2100
- https://access.redhat.com/security/cve/cve-2023-20863
- https://spring.io/security/cve-2023-20863
- https://security.netapp.com/advisory/ntap-20240524-0015/
- https://nvd.nist.gov/vuln/detail/CVE-2023-20863
- https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e
- https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15
- https://github.com/spring-projects/spring-framework/commit/ebc82654282bda547fbc20a9749ab1bda886a46f
- https://security.netapp.com/advisory/ntap-20240524-0015
- https://github.com/advisories/GHSA-wxqc-pxw9-g2p8 (Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/252807
- https://www.ibm.com/support/pages/node/6998727 (Advisory)
Frequently Asked Questions
What is the vulnerability CVE-2023-20863?
CVE-2023-20863 is a flaw in Spring Framework where certain versions of Spring Framework's Expression Language do not restrict the size of Spring Expressions, allowing an attacker to cause a denial of service on the server.
What is the severity of CVE-2023-20863?
The severity of CVE-2023-20863 is medium with a CVSS score of 6.5.
Which versions of Spring Framework are affected by CVE-2023-20863?
Versions of Spring Framework prior to 5.2.24, 5.3.27, and 6.0.8 are affected by CVE-2023-20863.
How can I fix CVE-2023-20863?
To fix CVE-2023-20863, update your Spring Framework to version 5.2.24, 5.3.27, or 6.0.8.
Where can I find more information about CVE-2023-20863?
You can find more information about CVE-2023-20863 at the following references: [CVE-2023-20863](https://www.cve.org/CVERecord?id=CVE-2023-20863), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-20863), [Spring Security](https://spring.io/security/cve-2023-20863), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2187742), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2023:2099).
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-20863
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/description
- agent/author
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-wxqc-pxw9-g2p8
- agent/references
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- collector/ibm-support
- source/IBM
- vendor/vmware
- canonical/vmware spring framework
- version/vmware spring framework/5.2.0
- version/vmware spring framework/5.3.0
- version/vmware spring framework/6.0.0
- package-manager/redhat
- package-manager/maven
- vendor/ibm
- canonical/ibm cloud pak for business automation
- version/ibm cloud pak for business automation/v22.0.2 - v22.0.2-if004
- version/ibm cloud pak for business automation/v21.0.3 - v21.0.3-if020
- version/ibm cloud pak for business automation/v22.0.1 - v22.0.1-if006 and later fixesv21.0.2 - v21.0.2-if012 and later fixesv21.0.1 - v21.0.1-if007 and later fixesv20.0.1 - v20.0.3 and later fixesv19.0.1 - v19.0.3 and later fixesv18.0.0 - v18.0.2 and later fixes