| Package | libspring-java |
|---|---|
| Version | 3.0.6.RELEASE-17+deb8u2 |
| Related CVEs | CVE-2018-11039 |
The Spring Framework allows web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
For Debian 8 jessie, these problems have been fixed in version 3.0.6.RELEASE-17+deb8u2.
We recommend that you upgrade your libspring-java packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.