For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jaime_Beckman_2's avatar
Jaime_Beckman_2
Icon for Nimbostratus rankNimbostratus
Mar 09, 2018

CVE-2017-8046 Pivotal Spring Data REST Vulnerability

I can't find any information about this CVE on Dev Central. Is this CVE something that f5 ASM already has signature(s) for? Any information would be greatly appreciated.

 

Thank you.

 

ASM Advanced WAF
BIG-IP
security

2 Replies

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Mar 14, 2018

    Jamie, I believe that the exploit code for this CVE has not yet been published, so no signature is available yet. To remediate this vulnerability you can do two things for now:

     

    1. Disable HTTP Method "PATCH" from the list of allowed methods on your ASM policy (if enabled) - check with your application developers that they are actually using it and it is needed first

    2. Ask application owners to update the version of Spring framework on the backend servers to the latest one which fixes this vulnerability, these are:

       

      • Spring Data REST 2.6.9 (Ingalls SR9, Oct. 27th, 2017)

         

      • Spring Data REST 3.0.1 (Kay SR1, Oct. 27th 2017)

         

      • Spring Boot 1.5.9 (Oct, 28th 2017)

         

      • Spring Boot 2.0 M6 (Nov. 6th 2017)