A libspring-java security update has been released for Debian GNU/Linux 8 Extended LTS to address a the possibility of an XST (Cross Site Tracing) attack.
ELA-408-1 libspring-java security update
Package libspring-java
ELA-408-1 libspring-java security update
Version 3.0.6.RELEASE-17+deb8u2
Related CVEs CVE-2018-11039
The Spring Framework allows web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
For Debian 8 jessie, these problems have been fixed in version 3.0.6.RELEASE-17+deb8u2.
We recommend that you upgrade your libspring-java packages.
Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/
