spring-cloud-stream-4.0.3.jar: 1 vulnerabilities (highest severity is: 8.2) #19
Description
Vulnerable Library - spring-cloud-stream-4.0.3.jar
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/cloud/spring-cloud-function-context/4.0.3/spring-cloud-function-context-4.0.3.jar
Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (spring-cloud-stream version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2024-22271 |  High |
8.2 | spring-cloud-function-context-4.0.3.jar | Transitive | 4.1.2 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-22271
Vulnerable Library - spring-cloud-function-context-4.0.3.jar
Implementation of core API for Spring Cloud Function
Library home page: https://spring.io/spring-cloud
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/cloud/spring-cloud-function-context/4.0.3/spring-cloud-function-context-4.0.3.jar
Dependency Hierarchy:
- spring-cloud-stream-4.0.3.jar (Root Library)
- ❌ spring-cloud-function-context-4.0.3.jar (Vulnerable Library)
Found in HEAD commit: 08e2518182571896bdce327b2372043d635cb3b3
Found in base branch: main
Vulnerability Details
In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.
Specifically, an application is vulnerable when all of the following are true:
User is using Spring Cloud Function Web module
Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8
References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ History 2020-01-16: Initial vulnerability report published.
Publish Date: 2024-07-09
URL: CVE-2024-22271
CVSS 3 Score Details (8.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2024-22271
Release Date: 2024-07-09
Fix Resolution (org.springframework.cloud:spring-cloud-function-context): 4.1.2
Direct dependency fix Resolution (org.springframework.cloud:spring-cloud-stream): 4.1.2
Step up your Open Source Security Game with Mend here