kritik
CVE-2016-1000027
spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Red Hat (orta).
Açıklama
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.springframework:spring-web | 6.0.0 |
| chainguard | apache-nifi, geoserver-2.27, geoserver-2.28 ve 2 tane daha | 0 |
| debian 11 | libspring-java | 4.2.7-1 |
| debian 12 | libspring-java | 4.2.7-1 |
| debian 13 | libspring-java | 4.2.7-1 |
| debian 14 | libspring-java | 4.2.7-1 |
| echo | libspring-java | 4.2.7-1 |
| wolfi | apache-nifi | 0 |
8 kaynaktaki 12 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.springframework:spring-web | 6.0.0 |
| chainguard | apache-nifi | 0 |
| chainguard | geoserver-2.27 | 0 |
| chainguard | geoserver-2.28 | 0 |
| chainguard | ontop | 0 |
| chainguard | ontop-fips | 0 |
| debian 11 | libspring-java | 4.2.7-1 |
| debian 12 | libspring-java | 4.2.7-1 |
| debian 13 | libspring-java | 4.2.7-1 |
| debian 14 | libspring-java | 4.2.7-1 |
| echo | libspring-java | 4.2.7-1 |
| wolfi | apache-nifi | 0 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2016-1000027
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027
- https://github.com/spring-projects/spring-framework
- https://github.com/spring-projects/spring-framework/commit/2b051b8b321768a4cfef83077db65c6328ffd60f
- https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa
- https://github.com/spring-projects/spring-framework/issues/21680
- https://github.com/spring-projects/spring-framework/issues/24434
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-1231625331
21 referansın hepsi
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525
- https://jira.spring.io/browse/SPR-17143?redirect=false
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000027
- https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json
- https://security-tracker.debian.org/tracker/CVE-2016-1000027
- https://security.netapp.com/advisory/ntap-20230420-0009
- https://security.netapp.com/advisory/ntap-20230420-0009/
- https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now
- https://support.contrastsecurity.com/hc/en-us/articles/4402400830612-Spring-web-Java-Deserialization-CVE-2016-1000027
- https://www.cve.org/CVERecord?id=CVE-2016-1000027
- https://www.tenable.com/security/research/tra-2016-20