ELA-408-1 libspring-java security update

XST attack

2021-04-23
Packagelibspring-java
Version3.0.6.RELEASE-17+deb8u2
Related CVEs CVE-2018-11039


The Spring Framework allows web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.



For Debian 8 jessie, these problems have been fixed in version 3.0.6.RELEASE-17+deb8u2.

We recommend that you upgrade your libspring-java packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.