GHSA-4gc7-5j7h-4qph
Spring Framework DataBinder Case Sensitive Match Exception
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework:spring-context | >= 6.1.0, < 6.1.14 | 6.1.14 |
| Maven | org.springframework:spring-web | >= 6.1.0, < 6.1.14 | 6.1.14 |
| Maven | org.springframework:spring-web | >= 6.0.0, <= 6.0.24 | no fix listed |
| Maven | org.springframework:spring-context | >= 6.0.0, <= 6.0.24 | no fix listed |
| Maven | org.springframework:spring-context | <= 5.3.40 | no fix listed |
| Maven | org.springframework:spring-web | <= 5.3.40 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2024-38820
- https://github.com/spring-projects/spring-framework/commit/23656aebc6c7d0f9faff1080981eb4d55eff296c
- https://github.com/spring-projects/spring-framework
- https://github.com/spring-projects/spring-framework/commits/v6.2.0-RC2
- https://security.netapp.com/advisory/ntap-20241129-0003
- https://spring.io/security/cve-2024-38820