Red Hat Security Advisory: Red Hat Virtualization security and bug fix update

Fixed packages 1

Vulnerabilities 2

• High 7.5
  CVE-2023-20860 Public exploit

  Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

  Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…

  libspring-java libspring-java org.springframework:spring-webmvc org.springframework:spring Debian Ubuntu Maven
  Mar 27, 2023
• Medium 6.5
  CVE-2023-20861

  Spring Framework vulnerable to denial of service via specially crafted SpEL expression

  In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Mar 23, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180230
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2180530
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184623
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2203132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2210036
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3771.json
• report
  https://access.redhat.com/security/cve/CVE-2023-20860
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-20860
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-20860
• article
  https://spring.io/blog/2023/03/20/spring-framework-6-0-7-and-5-3-26-fix-cve-2023-20860-and-cve-2023-20861
• report
  https://access.redhat.com/security/cve/CVE-2023-20861
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-20861
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-20861