CVE-2016-1000027: Critical severity VMware Spring Framework vulnerability
Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.
Maintainers recommend investigating alternative components or a potential mitigating control. Version 4.2.6 and 3.2.17 contain enhanced documentation advising users to take precautions against unsafe Java deserialization, version 5.3.0 deprecate the impacted classes and version 6.0.0 removed it entirely.
Other sources
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-1000027?
CVE-2016-1000027 is a vulnerability in the Pivotal Spring Framework that allows a remote attacker to execute arbitrary code on the system.
How does CVE-2016-1000027 occur?
CVE-2016-1000027 occurs due to a potential remote code execution (RCE) issue when the Pivotal Spring Framework is used for Java deserialization of untrusted data.
What is the severity of CVE-2016-1000027?
CVE-2016-1000027 has a severity rating of 9.8 (Critical).
Which software is affected by CVE-2016-1000027?
The Pivotal Spring Framework versions before 6.0.0, the libspring-java package on Debian, and IBM QRadar SIEM versions 7.5.0 - 7.5.0 UP6 are affected by CVE-2016-1000027.
How can I fix CVE-2016-1000027?
To fix CVE-2016-1000027, upgrade to Pivotal Spring Framework 6.0.0 or later, update the libspring-java package on Debian to versions 4.3.22-4 or 4.3.30-2, and upgrade IBM QRadar SIEM to a version beyond 7.5.0 UP6.