CVE-2015-5211

NameCVE-2015-5211
DescriptionUnder some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1853-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libspring-java (PTS)jessie, jessie (lts)3.0.6.RELEASE-17+deb8u2fixed
stretch (security), stretch (lts), stretch4.3.5-1+deb9u1fixed
buster4.3.22-4fixed
bullseye4.3.30-1fixed
sid, trixie, bookworm4.3.30-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libspring-javasourcejessie3.0.6.RELEASE-17+deb8u1DLA-1853-1
libspring-javasource(unstable)4.1.9-1

Notes

[wheezy] - libspring-java <no-dsa> (Minor issue)
https://jira.spring.io/browse/SPR-13548
https://github.com/spring-projects/spring-framework/commit/2bd1da
https://github.com/spring-projects/spring-framework/commit/a95c3d
https://github.com/spring-projects/spring-framework/commit/03f547
https://pivotal.io/security/cve-2015-5211

Search for package or bug name: Reporting problems