Design/Logic Flaw

2016-07-1219:59:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

High

0.03 Low

EPSS

Percentile

91.0%

JSON

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

CPENameOperatorVersion
fedoraeq22
fedoraeq21
spring_frameworkeq3.2.0
spring_frameworkeq4.1.0
spring_frameworkeq3.2.2
spring_frameworkeq3.2.1
spring_frameworkeq3.2.8
spring_frameworkeq3.2.7
spring_frameworkeq3.2.10
spring_frameworkeq3.2.9

Name	Operator	Version
fedora	eq	22
fedora	eq	21
spring_framework	eq	3.2.0
spring_framework	eq	4.1.0
spring_framework	eq	3.2.2
spring_framework	eq	3.2.1
spring_framework	eq	3.2.8
spring_framework	eq	3.2.7
spring_framework	eq	3.2.10
spring_framework	eq	3.2.9