| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.springframework.boot:spring-boot-autoconfigure | ≥ 2.6.0, < 2.6.15≥ 2.7.0, < 2.7.12≥ 3.0.0, < 3.0.7< 2.5.15 | 2.6.152.7.123.0.72.5.15 |
| spring boot | ≥ 2.6.0, ≤ 2.6.14≥ 2.7.0, ≤ 2.7.11≥ 3.0.0, ≤ 3.0.6< 2.5.14 | 2.5.14 |
In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.
Specifically, an application is vulnerable if all of the conditions are true:
Your application is NOT vulnerable if any of the following are true:
Affected Spring Products and Versions
Spring Boot
3.0.0 to 3.0.6 2.7.0 to 2.7.11 2.6.0 to 2.6.14 2.5.0 to 2.5.14
Older, unsupported versions are also affected Mitigation
Users of affected versions should apply the following mitigations:
Users of older, unsupported versions should upgrade to 3.0.7+ or 2.7.12+.
Workarounds: configure the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン