Candidate: CVE-2016-5007
PublicDate: 2017-05-25 17:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5007
 https://pivotal.io/security/cve-2016-5007
Description:
 Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x,
 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for
 mapping requests to controllers respectively. Differences in the strictness
 of the pattern matching mechanisms, for example with regards to space
 trimming in path segments, can lead Spring Security to not recognize
 certain paths as not protected that are in fact mapped to Spring MVC
 controllers that should be protected. The problem is compounded by the fact
 that the Spring Framework provides richer features with regards to pattern
 matching as well as by the fact that pattern matching in each Spring
 Security and the Spring Framework can easily be customized creating
 additional differences.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by: Clément Notin
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N [7.5 HIGH]

Patches_libspring-java:
 upstream: https://github.com/spring-projects/spring-framework/commit/a30ab3
 upstream: https://github.com/spring-projects/spring-security/commit/e4c13e
upstream_libspring-java: needs-triage
precise_libspring-java: ignored (reached end-of-life)
precise/esm_libspring-java: DNE (precise was needs-triage)
trusty_libspring-java: ignored (out of standard support)
trusty/esm_libspring-java: needed
vivid/stable-phone-overlay_libspring-java: DNE
vivid/ubuntu-core_libspring-java: DNE
wily_libspring-java: ignored (reached end-of-life)
xenial_libspring-java: ignored (end of standard support, was needed)
yakkety_libspring-java: ignored (reached end-of-life)
zesty_libspring-java: ignored (reached end-of-life)
artful_libspring-java: ignored (reached end-of-life)
bionic_libspring-java: not-affected (4.3.1-1)
cosmic_libspring-java: not-affected (4.3.1-1)
disco_libspring-java: not-affected (4.3.1-1)
eoan_libspring-java: not-affected (4.3.1-1)
focal_libspring-java: not-affected (4.3.1-1)
groovy_libspring-java: not-affected (4.3.1-1)
hirsute_libspring-java: not-affected (4.3.1-1)
impish_libspring-java: not-affected (4.3.1-1)
jammy_libspring-java: not-affected (4.3.1-1)
devel_libspring-java: not-affected (4.3.1-1)