CVE-2021-22096
Fixed in a distro release EPSS 1%
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.
Products: vmware spring_framework, netapp active_iq_unified_manager, management_services_for_element_software_and_netapp_hci, netapp metrocluster_tiebreaker, netapp snap_creator_framework, netapp snapcenter, oracle communications_cloud_native_core_console, oracle communications_cloud_native_core_service_communication_proxy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework:spring | 5.2.18 |
| Maven | org.springframework:spring | 5.3.11 |
| Maven | org.springframework:spring-core | 5.3.11 |
| Maven | org.springframework:spring-core | 5.2.18 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libspring-java | no fix |
| Debian 13 | libspring-java | no fix |
| Debian 14 | libspring-java | no fix |
| Red Hat rhev manager 4.4 el8 | apache-commons-compress | 0:1.21-1.2.el8ev |
| Red Hat rhev manager 4.4 el8 | apache-commons-compress-javadoc | 0:1.21-1.2.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-dependencies | 0:4.5.2-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-backend | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-dbscripts | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-health-check-bundler | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-restapi | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-base | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-cinderlib | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-imageio | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools-backup | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-ui-extensions | 0:1.3.5-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-vmconsole-proxy-helper | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-webadmin-portal | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-websocket-proxy | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-log-collector | 0:4.4.7-2.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-web-ui | 0:1.9.1-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-web-ui | 0:1.9.0-1.el8ev |
| Red Hat rhev manager 4.4 el8 | python3-ovirt-engine-lib | 0:4.5.2.4-0.1.el8ev |
| Red Hat rhev manager 4.4 el8 | rhvm | 0:4.5.2.4-0.1.el8ev |
| Ubuntu 25.10 | libspring-java | no fix |
| Ubuntu 26.04 LTS | libspring-java | no fix |
| Ubuntu 26.10 | libspring-java | no fix |
| Ubuntu Pro 14.04 LTS | libspring-java | no fix |
| Ubuntu Pro 16.04 LTS | libspring-java | no fix |
| Ubuntu Pro 18.04 LTS | libspring-java | no fix |
| Ubuntu Pro 20.04 LTS | libspring-java | no fix |
| Ubuntu Pro 22.04 LTS | libspring-java | no fix |
| Ubuntu Pro 24.04 LTS | libspring-java | no fix |