REDHAT-BUG-2467619: High severity Pivotal Software Spring Cloud Config vulnerability
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Cloud Configto a version that resolves this vulnerability.Fixed in 3.1.14 - Upgrade
Upgrade
Spring Cloud Configto a version that resolves this vulnerability.Fixed in 4.1.10 - Upgrade
Upgrade
Spring Cloud Configto a version that resolves this vulnerability.Fixed in 4.2.7 - Upgrade
Upgrade
Spring Cloud Configto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
Spring Cloud Configto a version that resolves this vulnerability.Fixed in 5.0.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2467619?
The severity of REDHAT-BUG-2467619 is high with a score of 7.
How do I fix REDHAT-BUG-2467619?
Fixing REDHAT-BUG-2467619 involves updating Spring Cloud Config to a version that is not affected by the vulnerability.
What type of attack does REDHAT-BUG-2467619 allow?
REDHAT-BUG-2467619 allows for directory traversal attacks through the spring-cloud-config-server module.
Which versions of Spring Cloud Config are affected by REDHAT-BUG-2467619?
Versions 3.1.x of Spring Cloud Config are affected starting from 3.1.
Who is responsible for the Spring Cloud Config software related to REDHAT-BUG-2467619?
The Spring Cloud Config software is developed by Pivotal Software.