CVE-2018-1257: High severity VMware Spring Framework vulnerability
A flaw was found in Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
References: https://pivotal.io/security/cve-2018-1257
Other sources
Pivotal Spring Framework is vulnerable to a denial of service. By sending a specially-crafted message, a remote attacker could exploit this vulnerability to perform a regular expression denial of service attack.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1257?
CVE-2018-1257 is classified as a Medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2018-1257?
To resolve CVE-2018-1257, upgrade your Spring Framework versions to 5.0.6 or 4.3.17 or later.
What is the impact of exploiting CVE-2018-1257?
Exploiting CVE-2018-1257 can lead to a denial of service condition on affected applications.
Which versions are affected by CVE-2018-1257?
CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17.
Is there a workaround for CVE-2018-1257?
There are no specific workarounds for CVE-2018-1257; upgrading to a patched version is recommended.