| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework:spring-web | ≥ 4.0.0, < 4.1.7≥ 5.0.0.RC2, < 5.0.0.RC3< 3.2.14 | 4.1.75.0.0.RC33.2.14 |
| spring framework | = 3.2.0= 4.1.0 | |
| spring framework | = 3.2.1= 3.2.10= 3.2.11= 3.2.12= 3.2.13= 3.2.2= 3.2.3= 3.2.4= 3.2.5= 3.2.6= 3.2.7= 3.2.8= 3.2.9= 4.1.1= 4.1.2= 4.1.3= 4.1.4= 4.1.5= 4.1.6 |
Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free