CVE-2021-22096: Log Injection Vulnerability in libspring-java
Summary
CVE-2021-22096: In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. Affects libspring-java across 2 version ranges.
>= 5acffaa72da10ba42fe547eeea44d8615cbf99b9, <= 21c3b51e1fcf0a20f9880d280a71cbace4905e41
>= 927b8c15ef20eaaa4002d4b2170cc536a6d6aa35, <= e45e77fd47e38d008fff7151f47a49f0c4a38d3b
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-java is a library used in the Debian ecosystem (versions 10, 11, 12, and 13) that provides functionality for the Spring Framework. The Spring Framework is a popular Java framework used for building enterprise-level applications. libspring-java is susceptible to a log injection vulnerability in versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions. This vulnerability allows an attacker to insert additional log entries by providing malicious input.
Vulnerability Detail
The log injection vulnerability in libspring-java allows an attacker to manipulate the log entries by injecting malicious input. This can lead to various security issues, such as log forging, log injection attacks, or log injection-based exploitation of other vulnerabilities. The vulnerability affects versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions of libspring-java. The CVSS score for this vulnerability is 4.3, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general best practice, it is recommended to validate and sanitize user input before using it in log entries to mitigate the risk of log injection attacks.
Conclusion
The log injection vulnerability in libspring-java can be mitigated by upgrading to a patched version of the library. It is important to keep software dependencies up to date to ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libspring-java →
FAQ
libspring-java is a library used in the Debian ecosystem that provides functionality for the Spring Framework.
The vulnerability allows an attacker to insert additional log entries, which can lead to log forging, log injection attacks, or exploitation of other vulnerabilities.
Versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions are affected.
The CVSS score for this vulnerability is 4.3, indicating a medium severity level.
To fix this vulnerability, it is recommended to upgrade to a patched version of libspring-java (5.3.11 or 5.2.18) or a newer supported version.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
