CVE-2021-22060: Log Injection Vulnerability in libspring-java
Summary
CVE-2021-22060: In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. Affects libspring-java across 2 version ranges.
>= 5acffaa72da10ba42fe547eeea44d8615cbf99b9, <= 23bb745ea49ae3d5ae58638e465c54a3595c5f78
>= 927b8c15ef20eaaa4002d4b2170cc536a6d6aa35, <= a1225f0de3a03474c6152f20b4233b56ac488327
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a Java library that is part of the Spring Framework. It provides various utilities and components for building Java applications. The library is widely used in the Debian ecosystem, specifically in versions 10, 11, 12, and 13. It is vulnerable to a log injection attack, which allows an attacker to insert additional log entries by providing malicious input. This vulnerability affects Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions.
Vulnerability Detail
The log injection vulnerability in libspring-java allows an attacker to manipulate the logging mechanism by injecting malicious input. By exploiting this vulnerability, an attacker can insert additional log entries, potentially leading to log forging or log injection attacks. This can have various consequences, such as tampering with log records, obfuscating important log entries, or flooding the logs with irrelevant or misleading information. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization techniques to prevent malicious input from being processed by the logging mechanism. Additionally, it is recommended to review and adjust the log configuration to ensure that log entries are properly formatted and validated. Here is an example of input validation and sanitization in Java:
String sanitizedInput = input.replaceAll("[\\r\\n]+", "");
logger.info(sanitizedInput);
This code snippet removes any newline or carriage return characters from the input before logging it.
Conclusion
The log injection vulnerability in libspring-java can be mitigated by upgrading to a patched version of the Spring Framework. It is important to keep software dependencies up to date to minimize the risk of log injection attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libspring-java →
FAQ
libspring-java is a Java library that is part of the Spring Framework. It provides utilities and components for building Java applications.
The vulnerability affects libspring-java in versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions.
The vulnerability allows an attacker to insert additional log entries, potentially leading to log forging or log injection attacks.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to a patched version of the Spring Framework.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
