In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Spring_framework | Vmware | 5.2.0 (including) | 5.2.17 (including) |
Spring_framework | Vmware | 5.3.0 (including) | 5.3.10 (including) |
Red Hat Fuse 7.11 | RedHat | springframework | * |
Red Hat Virtualization Engine 4.4 | RedHat | ovirt-dependencies-0:4.5.2-1.el8ev | * |
Red Hat Virtualization Engine 4.4 | RedHat | org.ovirt.engine-root-0:4.5.2.4-1 | * |
RHDM 7.12.1 | RedHat | springframework | * |
RHPAM 7.12.1 | RedHat | springframework | * |
Libspring-java | Ubuntu | bionic | * |
Libspring-java | Ubuntu | focal | * |
Libspring-java | Ubuntu | hirsute | * |
Libspring-java | Ubuntu | impish | * |
Libspring-java | Ubuntu | kinetic | * |
Libspring-java | Ubuntu | lunar | * |
Libspring-java | Ubuntu | mantic | * |
Libspring-java | Ubuntu | oracular | * |
Libspring-java | Ubuntu | trusty | * |
Libspring-java | Ubuntu | trusty/esm | * |
Libspring-java | Ubuntu | xenial | * |