Update GHSA-r4q3-7g4q-x89m.json CVE-2024-22233

[prabhu]

spring-core is not affected by this vulnerability. Rather, applications must be using spring-webmvc with spring-security-core (used or available in classpath). Since expressing such a condition is not possible with this schema, my edit would still result in false positives.

[JonathanLEvans]

Hi @prabhu, do you have reference links showing that spring-core is unaffected and the other packages are? Links to the commits that fix the issue would be especially helpful.

[prabhu]

@JonathanLEvans, best to get it confirmed by someone from spring team. But below is my understanding.

• I read the description in https://spring.io/security/cve-2024-22233/
• Came across this commit that replaces matches with equals. The original commit that added this offending line is this as part of a feature requested for spring-security (Integrate HandlerMappingIntrospector Caching spring-projects/spring-security#14128)

The new filter is part of spring-webmvc and comes into the picture only when spring-security is available in the class path. The commit that introduces HandlerMappingIntrospector to spring-security is here

Some sample payloads to cause dos with matches (from LiveOverflow twitter).

/.(.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a.*a)+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!

"(.*a){100}aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!"

Related tickets

spring-projects/spring-framework#31937

To conclude, please try and seek official confirmation from the spring team since it is possible I might have missed something somewhere.

[JonathanLEvans]

Hi @prabhu, the commit you provided does not clearly relate to the vulnerability. As you suggested, we reached out to the Spring team but have not received clarification. Without further clarification, we will continue to list spring-core as the affected package since https://spring.io/security/cve-2024-22233/ says to update the entire framework.