Input validation error in Spring Framework - CVE-2024-38809

Vulnerability identifier: #VU96018

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38809

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing ETags from "If-Match" or "If-None-Match" request headers. A remote attacker can send a specially crafted HTTP request to the application and perform a denial of service (DoS) attack.

Spring Framework
IBM Cloud Pak for Security
Enterprise Project Connection
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Observability with Instana
Unified OSS Console Assurance Monitoring (UOCAM)
IBM Cloud Object Storage Systems
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM SPSS Collaboration and Deployment Services
IBM Security Verify Governance
IBM Business Automation Workflow
QRadar Suite
watsonx.data
DB2 Data Management Console
OpenPages for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
IBM Tivoli Netcool Configuration Manager
Oracle BI Publisher
Oracle Business Intelligence Enterprise Edition
IBM Business Automation Manager Open Editions
OpenPages Cloud pak for data service version
IBM Engineering Requirements Management DOORS Next
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
Storage Copy Data Management
IBM Tivoli Application Dependency Discovery Manager
Cloud Foundry UAA
Planning Analytics Local
HPE Unified OSS Console (UOC)
Red Hat Camel for Spring Boot
IBM Qradar SIEM
IBM Cognos Controller

Install updates from vendor's website.

Spring Framework - addressed in versions 5.3.38, 6.0.23, 6.1.12, 6.2.0-M7
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
watsonx.data - update to 2.1
DB2 Data Management Console - update to 3.1.13.2
OpenPages for IBM Cloud Pak for Data - update to 5.3.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.22
IBM Business Automation Manager Open Editions - update to 8.0.7
OpenPages Cloud pak for data service version - update to 9.6.0
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
Cloud Foundry UAA - update to 77.15.0
IBM Observability with Instana - update to 286
Planning Analytics Local - addressed in versions 2.0.0.99, 2.1.6
Storage Copy Data Management - update to 2.2.26.0
HPE Unified OSS Console (UOC) - update to 3.1.12
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.12
IBM Cloud Object Storage Systems - addressed in versions 3.18.0.75, 3.18.4.45
Red Hat Camel for Spring Boot - update to 4.4.3
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF01
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.13
IBM Security Verify Governance - update to 10.0.2.0.4
IBM Cognos Controller - addressed in versions 11.0.1.4, 11.1.0.2
IBM Business Automation Workflow - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1.0

• https://spring.io/security/cve-2024-38809

• Denial of service in Spring Framework via conditional HTTP request
• Multiple vulnerabilities in IBM Cloud Object System
• Multiple vulnerabilities in SAP Enterprise Project Connection
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• uaa update for Spring Framework
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.4
• Multiple vulnerabilities in Oracle BI Publisher
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Planning Analytics
• IBM Tivoli Application Dependency Discovery Manager update for Spring Framework
• Multiple vulnerabilities in HPE Unified OSS Console (UOC) and Unified OSS Console Assurance Monitoring (UOCAM)
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM watsonx.data
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for VMware Tanzu Spring Framework
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Tivoli Network Configuration Manager
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in IBM OpenPages for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS and DOORS Web Access
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition