REDHAT-BUG-2055480: Low severity vmware spring framework vulnerability
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
https://nvd.nist.gov/vuln/detail/CVE-2021-22060 https://tanzu.vmware.com/security/cve-2021-22060
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2055480?
The severity of REDHAT-BUG-2055480 is considered high due to the potential for log injection attacks.
How do I fix REDHAT-BUG-2055480?
To fix REDHAT-BUG-2055480, update Spring Framework to version 5.3.14 or later, or 5.2.19 or later.
What versions are affected by REDHAT-BUG-2055480?
Affected versions include Spring Framework 5.3.0 to 5.3.13 and 5.2.0 to 5.2.18.
What types of applications are impacted by REDHAT-BUG-2055480?
Applications that utilize vulnerable versions of the Spring Framework for logging functionality are impacted.
Is REDHAT-BUG-2055480 a known vulnerability?
Yes, REDHAT-BUG-2055480 is a recognized vulnerability related to log injection in specific versions of the Spring Framework.