CVE-2015-3192 Pivotal Spring Framework DoS Attack with XML Input
MediumCVSS 5.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-web(Maven) | < 3.2.14 | 3.2.14 |
| org.springframework/spring-web(Maven) | = 1.0 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.0-rc1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.0.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1-rc1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1-rc2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.3 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.4 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.1.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2-rc1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2-rc2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.3 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.4 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.6 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.7 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.8 | No fix listed |
| org.springframework/spring-web(Maven) | = 1.2.9 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0 | No fix listed |
Show 98 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework/spring-web(Maven) | = 2.0-m1 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-m2 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-m3 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-m4 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-m5 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-rc1 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0-rc2 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.3 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.4 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.6 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.7 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.0.8 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.1 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.2 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.3 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.4 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.5 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.6 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.6.SEC01 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.6.SEC02 | No fix listed |
| org.springframework/spring-web(Maven) | = 2.5.6.SEC03 | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.0.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.1.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.2.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.3.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.4.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.5.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.6.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.0.7.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.0.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.1.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.2.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.3.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.1.4.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.0.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.1.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.10.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.11.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.12.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.13.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.2.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.3.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.4.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.5.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.6.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.7.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.8.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 3.2.9.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | >= 4.0.0, < 4.1.7 | 4.1.7 |
| org.springframework/spring-web(Maven) | = 4.0.0.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.1.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.2.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.3.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.4.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.5.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.6.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.7.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.8.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.0.9.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.1.0.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.1.1.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.1.2.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.1.3.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.1.4.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.1.5.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | = 4.1.6.RELEASE | No fix listed |
| org.springframework/spring-web(Maven) | >= 5.0.0.RC2, < 5.0.0.RC3 | 5.0.0.RC3 |
| org.springframework/spring-web(Maven) | = 5.0.0.RC2 | No fix listed |
| debian/libspring-java(Debian:12) | < 4.1.9-1 | 4.1.9-1 |
| debian/libspring-java(Debian:13) | < 4.1.9-1 | 4.1.9-1 |
| debian/libspring-java(Debian:14) | < 4.1.9-1 | 4.1.9-1 |
| pivotal software spring framework | = 3.2.0 | No fix listed |
| pivotal software spring framework | = 4.1.0 | No fix listed |
| VMware spring framework | = 3.2.1 | No fix listed |
| VMware spring framework | = 3.2.2 | No fix listed |
| VMware spring framework | = 3.2.3 | No fix listed |
| VMware spring framework | = 3.2.4 | No fix listed |
| VMware spring framework | = 3.2.5 | No fix listed |
| VMware spring framework | = 3.2.6 | No fix listed |
| VMware spring framework | = 3.2.7 | No fix listed |
| VMware spring framework | = 3.2.8 | No fix listed |
| VMware spring framework | = 3.2.9 | No fix listed |
| VMware spring framework | = 3.2.10 | No fix listed |
| VMware spring framework | = 3.2.11 | No fix listed |
| VMware spring framework | = 3.2.12 | No fix listed |
| VMware spring framework | = 3.2.13 | No fix listed |
| VMware spring framework | = 4.1.1 | No fix listed |
| VMware spring framework | = 4.1.2 | No fix listed |
| VMware spring framework | = 4.1.3 | No fix listed |
| VMware spring framework | = 4.1.4 | No fix listed |
| VMware spring framework | = 4.1.5 | No fix listed |
| VMware spring framework | = 4.1.6 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- spring.io
- [debian-lts-announce] 20190713 [SECURITY] [DLA 1853-1] libspring-java security update mailing-list
- jira.spring.io
- jira.spring.io
- github.com product
- github.com vendor-advisory
- RHSA-2016:1219 vendor-advisory
- RHSA-2016:1218 vendor-advisory
- FEDORA-2015-11184 vendor-advisory
- FEDORA-2015-11165 vendor-advisory
- RHSA-2016:1592 vendor-advisory
- RHSA-2016:1593 vendor-advisory
- RHSA-2016:2035 vendor-advisory
- RHSA-2016:2036 vendor-advisory
- 90853 vdb-entry
- 1036587 vdb-entry
- Debian Security Tracker CVE-2015-3192 vendor-advisory
- pivotal.io vendor-advisory
- bugs.debian.org issue-tracking