DescriptionSpring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)
Debian Bugs895114

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libspring-java (PTS)jessie3.0.6.RELEASE-17fixed
jessie (security)3.0.6.RELEASE-17+deb8u1fixed
bullseye, sid, buster4.3.22-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libspring-javasourcejessie(not affected)
libspring-javasourcewheezy(not affected)


[stretch] - libspring-java <no-dsa> (Minor issue)
[jessie] - libspring-java <not-affected> (vulnerable code not found)
[wheezy] - libspring-java <not-affected> (Vulnerable broker code introduced in various commits re.
when addressing this issue make sure to not only apply a partial fix but
make it complete, cf.

Search for package or bug name: Reporting problems