Red Hat JBossEAP: Uncontrolled Resource Consumption (CVE-2024-38808)

Red Hat JBossEAP: Uncontrolled Resource Consumption (CVE-2024-38808)

Severity

5

CVSS

(AV:N/AC:H/Au:N/C:N/I:N/A:C)

Published

08/20/2024

Created

09/20/2024

Added

09/04/2024

Modified

09/20/2024

Description

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the following is true: *The application evaluates user-supplied SpEL expressions.. A flaw was found in the Spring framework package. A maliciously crafted Spring Expression Language (SePL) may trigger uncontrolled CPU usage, leading to a denial of service in the application consuming it. To be considered vulnerable, one application has to evaluate user-supplied SpEL expressions.

Solution(s)

• red-hat-jboss-eap-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-38808
• CVE - 2024-38808
• https://access.redhat.com/security/cve/CVE-2024-38808
• https://bugzilla.redhat.com/show_bug.cgi?id=2305959
• https://spring.io/security/cve-2024-38808