[AMQ-9520] CVE-2024-22262 - Spring Framework URL Parsing with Host Validation in Web

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.18.3
• Fix Version/s: 5.18.5
• Component/s: Web Console
• Labels: security
• Assignee: Jean-Baptiste Onofré
• Reporter: Sjohn Chambers
• Created: 09/Jul/24 15:42
• Updated: 11/Jul/24 04:33
• Resolved: 11/Jul/24 04:33

Description

We've detected that this version as well as current releases have a spring framework version that is vulnerable to CVE-2024-22262. 

Mostly looking for release information on the next version that should have an update included.

 

https://spring.io/security/cve-2024-22262

Issue Links

• is blocked by: AMQ-9529 Upgrade to Spring 5.3.37