Spring Cloud Function Framework vulnerable to Denial of Service
High severity
GitHub Reviewed
Published
Jul 9, 2024
to the GitHub Advisory Database
•
Updated Jul 9, 2024
Package
Affected versions
>= 4.0.0, < 4.0.8
>= 4.1.0, < 4.1.2
Patched versions
4.0.8
4.1.2
Description
Published by the National Vulnerability Database
Jul 9, 2024
Published to the GitHub Advisory Database
Jul 9, 2024
Reviewed
Jul 9, 2024
Last updated
Jul 9, 2024
In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.
Specifically, an application is vulnerable when all of the following are true:
User is using Spring Cloud Function Web module
Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8
References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ History 2020-01-16: Initial vulnerability report published.
References