Input validation error in Spring Framework - CVE-2024-38809

Vulnerability identifier: #VU96018

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-38809

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Spring Framework
IBM Cloud Pak for Security
Enterprise Project Connection
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Observability with Instana
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Object Storage Systems
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM SPSS Collaboration and Deployment Services
IBM Security Verify Governance
IBM Business Automation Workflow
QRadar Suite
watsonx.data
DB2 Data Management Console
OpenPages for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
IBM Tivoli Netcool Configuration Manager
Oracle BI Publisher
Oracle Business Intelligence Enterprise Edition
IBM Business Automation Manager Open Editions
OpenPages Cloud pak for data service version
IBM Engineering Requirements Management DOORS Next
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
Storage Copy Data Management
IBM Tivoli Application Dependency Discovery Manager
Cloud Foundry UAA
Planning Analytics Local
HPE Unified OSS Console (UOC)
Red Hat Camel for Spring Boot
IBM Qradar SIEM
IBM Cognos Controller

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing ETags from "If-Match" or "If-None-Match" request headers. A remote attacker can send a specially crafted HTTP request to the application and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://spring.io/security/cve-2024-38809