CVE-2016-1000027 in Spring-Web

[qligier]

Package: org.springframework:spring-web
Installed Version: 5.3.27
Vulnerability CVE-2016-1000027
Severity: CRITICAL
Fixed Version: 6.0.0
Link: CVE-2016-1000027

[qligier]

spring-projects/spring-framework#24434 (comment)

TL;DR: this is an old CVE, the information is still relevant and it can't be "fixed" in Spring Framework since it's about avoiding to expose HTTP Invoker endpoints to untrusted clients - there's been an official warning about this in our documentation for years now.

spring-projects/spring-framework#24434 (comment)

Having said that it can be used as a reminder to check that there are no HTTP Invoker endpoints exposed to untrusted clients. If there are none, then nothing further to do.

spring-projects/spring-framework#24434 (comment)

I guess that tools like NexusIQ aren't doing static code analysis but rather just looking at the dependency graph - otherwise they wouldn't flag your application: looking for HTTPInvokerServiceExporter or RemoteInvocationSerializingExporter usage in the application code would be an easy way to prevent most false positives.

We don't use HTTPInvokerServiceExporter or RemoteInvocationSerializingExporter in Matchbox.

This will be fixed by upgrading to v6.

[oliveregger]

we need also to look at the medium issues for the next release

[qligier]

Done in 5f29a52