CVE-2015-3192: org.springframework:spring-core - Denial of Service Vulnerability
Summary
CVE-2015-3192: Pivotal Spring Framework DoS Attack with XML Input. Affects org.springframework:spring-web across 3 version ranges.
< 3.2.14
>= 4.0.0, < 4.1.7
>= 5.0.0.RC2, < 5.0.0.RC3
Fixed in 3.2.14, 4.1.7 or 5.0.0.RC3, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2015-3192 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.springframework:spring-core is a core module of the Spring Framework, which provides essential features and utilities for Spring-based applications. It is widely used in Java applications for dependency injection, transaction management, and other enterprise-level functionalities. This vulnerability affects versions before 3.2.14 and 4.x before 4.1.7 of the framework.
Vulnerability Detail
The vulnerability (CVE-2015-3192) in org.springframework:spring-core arises from improper processing of inline DTD declarations when DTD is not entirely disabled. This flaw allows remote attackers to launch a denial of service attack by exploiting a crafted XML file. By sending a malicious XML file, an attacker can cause excessive memory consumption and trigger out-of-memory errors, leading to service disruption and potential system crashes.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.2.143.2.14 -
>= 4.0.0, < 4.1.74.1.7 -
>= 5.0.0.RC2, < 5.0.0.RC35.0.0.RC3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is possible to disable DTD processing entirely by configuring the XML parser used by the application. This can be achieved by setting the 'http://apache.org/xml/features/disallow-doctype-decl' property to 'true'. However, this workaround may impact the functionality of the application if it relies on DTD processing for legitimate purposes. It is recommended to apply the official fix as soon as possible.
Conclusion
The vulnerability in org.springframework:spring-core can be exploited by remote attackers to cause a denial of service. To mitigate this risk, it is crucial to update to the fixed version of the framework. Alternatively, a temporary workaround can be applied by disabling DTD processing, but this may impact the application's functionality. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-web →
FAQ
The vulnerability allows remote attackers to cause a denial of service by consuming excessive memory and triggering out-of-memory errors. This can lead to service disruption and potential system crashes.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
While there are no known public exploits for this vulnerability, it is still important to apply the fix to prevent potential attacks.
As a temporary workaround, you can disable DTD processing entirely by configuring the XML parser. However, this may impact the functionality of the application and it is recommended to apply the official fix.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2015-3192
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-web.
