Vulnerability Description
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Framework | < 6.0.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027Issue TrackingThird Party Advisory
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-57Issue TrackingThird Party Advisory
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-58Issue TrackingThird Party Advisory
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-74Issue TrackingThird Party Advisory
- https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/Broken LinkExploitThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2016-1000027Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230420-0009/
- https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-nRelease NotesThird Party Advisory
- https://www.tenable.com/security/research/tra-2016-20ExploitThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027Issue TrackingThird Party Advisory
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-57Issue TrackingThird Party Advisory
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-58Issue TrackingThird Party Advisory
- https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-74Issue TrackingThird Party Advisory
- https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/Broken LinkExploitThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2016-1000027Third Party Advisory
FAQ
What is CVE-2016-1000027?
CVE-2016-1000027 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented withi...
How severe is CVE-2016-1000027?
CVE-2016-1000027 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-1000027?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Spring Framework.