Medium · published May 12, 2018
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
| Product | Versions | Fixed in |
|---|---|---|
| vmware/spring_framework | < 4.3.17 | 4.3.17 |
| vmware/spring_framework | ≥ 5.0.0, < 5.0.6 | 5.0.6 |
| redhat/openshift | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/application_testing_suite | all versions | — |
| oracle/application_testing_suite | all versions | — |
| oracle/application_testing_suite | all versions | — |
| oracle/application_testing_suite | all versions | — |
| oracle/big_data_discovery | all versions | — |
| oracle/communications_converged_application_server | < 7.0.0.1 | 7.0.0.1 |
| oracle/communications_diameter_signaling_router | < 8.3 | 8.3 |
| oracle/communications_performance_intelligence_center | < 10.2.1 | 10.2.1 |
| oracle/communications_services_gatekeeper | < 6.1.0.4.0 | 6.1.0.4.0 |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/communications_unified_inventory_management | all versions | — |
| oracle/endeca_information_discovery_integrator | all versions | — |
| oracle/endeca_information_discovery_integrator | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_base_platform | all versions | — |
| oracle/enterprise_manager_for_mysql_database | all versions | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/flexcube_private_banking | all versions | — |
| oracle/flexcube_private_banking | all versions | — |
| oracle/flexcube_private_banking | all versions | — |
| oracle/flexcube_private_banking | all versions | — |
| oracle/flexcube_private_banking | all versions | — |
| oracle/goldengate_for_big_data | all versions | — |
| oracle/goldengate_for_big_data | all versions | — |
| oracle/goldengate_for_big_data | all versions | — |
| oracle/health_sciences_information_manager | all versions | — |
| oracle/healthcare_master_person_index | all versions | — |
| oracle/healthcare_master_person_index | all versions | — |
| oracle/hospitality_guest_access | all versions | — |
| oracle/hospitality_guest_access | all versions | — |
| oracle/insurance_calculation_engine | all versions | — |
| oracle/insurance_calculation_engine | all versions | — |
| oracle/insurance_calculation_engine | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/insurance_rules_palette | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/primavera_gateway | all versions | — |
| oracle/retail_customer_insights | all versions | — |
| oracle/retail_customer_insights | all versions | — |
| oracle/retail_open_commerce_platform | all versions | — |
| oracle/retail_open_commerce_platform | all versions | — |
| oracle/retail_open_commerce_platform | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_order_broker | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/retail_predictive_application_server | all versions | — |
| oracle/service_architecture_leveraging_tuxedo | all versions | — |
| oracle/service_architecture_leveraging_tuxedo | all versions | — |
| oracle/tape_library_acsls | all versions | — |
| oracle/utilities_network_management_system | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |
| oracle/weblogic_server | all versions | — |