CVE-2015-3192 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2015-3192 - Medium Severity Vulnerability

Vulnerable Library - spring-web-3.1.1.RELEASE.jar

null

path: /root/.m2/repository/org/springframework/spring-web/3.1.1.RELEASE/spring-web-3.1.1.RELEASE.jar,2/repository/org/springframework/spring-web/3.1.1.RELEASE/spring-web-3.1.1.RELEASE.jar

Dependency Hierarchy:

• ❌ spring-web-3.1.1.RELEASE.jar (Vulnerable Library)

Found in HEAD commit: 23068bfa8fba8e934988efafc64fa2cf0fdb8462

Vulnerability Details

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

Publish Date: 2016-07-12

URL: CVE-2015-3192

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://pivotal.io/security/cve-2015-3192

Release Date: 2017-12-31

Fix Resolution: Users of affected Spring Framework versions should upgrade as follows: For 3.2.x upgrade to For 4.0.x and 4.1.x upgrade to In addition, applications that consume XML input via StAX from external sources should also use and/or upgrade to a recent version of the Woodstox library, e.g. version 4.2+ (4.2.1 is the currently curated version in the ).

---

Step up your Open Source Security Game with WhiteSource here