CVE-2021-22060: Log entry injection in Spring Framework

January 12, 2022 (updated January 18, 2022)

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.

References

github.com/advisories/GHSA-6gf2-pvqw-37ph
nvd.nist.gov/vuln/detail/CVE-2021-22060
tanzu.vmware.com/security/cve-2021-22060

Code Behaviors & Features

Detect and mitigate CVE-2021-22060 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →