CVE-2018-1274
published 2018-04-18CVE-2018-1274: Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.97%
78.1th percentile
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | spring_data_commons | < 1.13.11 | 1.13.11 |
| broadcom | spring_data_commons | >= 2.0.0 < 2.0.6 | 2.0.6 |
| pivotal_software | spring_data_rest | 3.0 – 3.0.5 | — |
| spring_by_pivotal | spring_framework | — | — |
| vmware | spring_data_rest | 2.6 – 2.6.10 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service
vendor_redhat·2018-04-04·CVSS 7.5
CVE-2018-1274 [HIGH] CWE-138 spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service
spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
Package: spring-data-commons (Red Hat Fuse 7) - Affected
Package: spring-data-commons (Red Hat JBoss Fuse 6) - Not affected
Package: spring-data-commons (Red Hat JBoss Fuse Integration Service 2) - Not affected
Package: spring-data-commons (Red Hat Mobile Application Platform 4) - Not
GHSA
Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
ghsa·2018-10-17
CVE-2018-1274 [HIGH] CWE-770 Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
OSV
Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
osv·2018-10-17
CVE-2018-1274 [HIGH] Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-1274 spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service
bugzilla·2018-04-11·CVSS 7.5
CVE-2018-1274 [HIGH] CVE-2018-1274 spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service
CVE-2018-1274 spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service
Spring Data Commons, versions 1.13 to 1.13.10 and 2.0 to 2.0.5, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
External References:
https://pivotal.io/security/cve-2018-1274
Upstream Issue:
https://jira.spring.io/browse/DATACMNS-1285
Upstream Patches:
https://github.com/spring-projects/spring-data-commons/commit/371f6590c509c72f8e600f3d05e110941607fbad
https://github.com/spring-projects/spring-data-comm
Bugzilla
CVE-2018-1274 springframework-data-commons: spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service [fedora-all]
bugzilla·2018-04-11·CVSS 7.5
CVE-2018-1274 [HIGH] CVE-2018-1274 springframework-data-commons: spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service [fedora-all]
CVE-2018-1274 springframework-data-commons: spring-data-commons: Unlimited path depth in PropertyPath.java allow remote attackers to cause a denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM
arXiv
How well does LLM generate security tests?
arxiv_fulltext·2023-10-03
How well does LLM generate security tests?
How well does LLM generate security tests?
## Abstract
Developers often build software on top of third-party libraries (Libs) to improve programmer productivity and software quality. The libraries may contain vulnerabilities exploitable by hackers to attack the applications (Apps) built on top of them. People refer to such attacks as supply chain attacks, the documented number of which has increased 742% in 2022. People created tools to mitigate such attacks, by scanning the library dependencies of Apps, identifying the usage of vulnerable library versions, and suggesting secure alternatives to vulnerable dependencies. However, recent studies show that many developers do not trust the reports by these tools; they ask for code or evidence to demonstrate how library vulnerabilities lead to
2018-04-18
Published