REDHAT-BUG-2055480
First published: Thu Feb 17 2022(Updated: )
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to <a href="https://access.redhat.com/security/cve/CVE-2021-22096">CVE-2021-22096</a> that protects against additional types of input and in more places of the Spring Framework codebase. <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-22060">https://nvd.nist.gov/vuln/detail/CVE-2021-22060</a> <a href="https://tanzu.vmware.com/security/cve-2021-22060">https://tanzu.vmware.com/security/cve-2021-22060</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Spring Framework | >=5.3.0<=5.3.13>=5.2.0<=5.2.18 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2021-22096
- https://nvd.nist.gov/vuln/detail/CVE-2021-22060
- https://tanzu.vmware.com/security/cve-2021-22060
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2062988
- https://access.redhat.com/errata/RHSA-2022:5532
- https://access.redhat.com/security/cve/cve-2021-22060
- https://bugzilla.redhat.com/show_bug.cgi?id=2055480
Frequently Asked Questions
What is the severity of REDHAT-BUG-2055480?
The severity of REDHAT-BUG-2055480 is considered high due to the potential for log injection attacks.
How do I fix REDHAT-BUG-2055480?
To fix REDHAT-BUG-2055480, update Spring Framework to version 5.3.14 or later, or 5.2.19 or later.
What versions are affected by REDHAT-BUG-2055480?
Affected versions include Spring Framework 5.3.0 to 5.3.13 and 5.2.0 to 5.2.18.
What types of applications are impacted by REDHAT-BUG-2055480?
Applications that utilize vulnerable versions of the Spring Framework for logging functionality are impacted.
Is REDHAT-BUG-2055480 a known vulnerability?
Yes, REDHAT-BUG-2055480 is a recognized vulnerability related to log injection in specific versions of the Spring Framework.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-22060
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/spring
- canonical/vmware spring framework