USN-7165-1: Spring Framework vulnerability
Published Dec 17, 2024
·Updated
It was discovered that the Spring Framework incorrectly handled web requests via data binding. An attacker could possibly use this issue to achieve remote code execution and obtain sensitive information.
Affected Software
160 affected componentsFixes available
All of the following
ubuntu/libspring-aop-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-beans-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-context-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-context-support-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-core-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-expression-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-instrument-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-jdbc-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-jms-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-messaging-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-orm-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-oxm-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-transaction-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-web-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-web-portlet-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-web-servlet-java<4.3.30-2ubuntu0.24.10.1
4.3.30-2ubuntu0.24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libspring-aop-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-beans-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-context-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-context-support-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-core-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-expression-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-instrument-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-jdbc-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-jms-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-messaging-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-orm-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-oxm-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-transaction-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-web-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-web-portlet-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-web-servlet-java<4.3.30-2ubuntu0.24.04.1~esm1
4.3.30-2ubuntu0.24.04.1~esm1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libspring-aop-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-beans-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-context-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-context-support-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-core-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-expression-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-instrument-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-jdbc-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-jms-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-messaging-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-orm-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-oxm-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-transaction-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-web-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-web-portlet-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-web-servlet-java<4.3.30-1ubuntu0.1~esm1
4.3.30-1ubuntu0.1~esm1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libspring-aop-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-beans-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-context-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-context-support-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-core-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-expression-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-instrument-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-jdbc-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-jms-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-messaging-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-orm-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-oxm-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-transaction-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-web-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-web-portlet-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-web-servlet-java<4.3.22-4ubuntu0.1~esm1
4.3.22-4ubuntu0.1~esm1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libspring-aop-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-beans-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-context-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-context-support-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-core-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-expression-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-instrument-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-jdbc-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-jms-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-messaging-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-orm-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-oxm-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-transaction-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-web-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-web-portlet-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libspring-web-servlet-java<4.3.22-1~18.04.1~esm1
4.3.22-1~18.04.1~esm1
Ubuntu Ubuntu=18.04
Event History
Dec 17, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-7165-1?
USN-7165-1 has a critical severity level due to the potential for remote code execution.
2
How do I fix USN-7165-1?
To fix USN-7165-1, upgrade to the recommended package version 4.3.30-2ubuntu0.24.10.1 or later.
3
Which software is affected by USN-7165-1?
USN-7165-1 affects multiple packages including libspring-aop-java, libspring-beans-java, libspring-context-java, and others.
4
Can USN-7165-1 lead to sensitive data exposure?
Yes, USN-7165-1 can result in sensitive information exposure through remote code execution.
5
Is there a workaround for the USN-7165-1 vulnerability?
Currently, the best course of action for USN-7165-1 is to apply the necessary updates to affected packages.