CVE-2026-40982 Spring Cloud Config allows applications to serve arbitrary text and binary files through the…
Description
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Cloud Config 5.0 | 5.0.0 → < 5.0.3 | 5.0.3 |
| Spring Cloud Config 4.3 | 4.3.0 → < 4.3.3 | 4.3.3 |
| Spring Cloud Config 4.2 | 4.2.0 → < 4.2.7 | 4.2.7 |
| Spring Cloud Config 4.1 | 4.1.0 → < 4.1.10 | 4.1.10 |
| Spring Cloud Config 3.1 | 3.1.0 → < 3.1.14 | 3.1.14 |
| Red Hat Enterprise Linux 8 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions non publiées |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification