Uploaded image for project: 'Spring Framework'
  1. Spring Framework
  2. SPR-13548

Protect against RFD exploits

This issue belongs to an archived project. You can view it, but you can't modify it. Learn more

    XMLWordPrintable

Details

    • Improvement
    • Status: Closed
    • Critical
    • Resolution: Complete
    • 3.2.14, 4.1.7, 4.2.1
    • 3.2.15, 4.1.8, 4.2.2
    • Web
    • Security Level: Public
    • true

    Description

      For details and concrete examples of RFD attacks see the RFD paper from Trustwave.

      For information specific to Spring MVC see the CVE-2015-5211 security report.

      Attachments

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. SPR-13647 Content Disposition header being added on some urls...did not behave this way in 4.2.1

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. SPR-13629 Content-Disposition added for @ResponseBody methods explicitly mapped to ".html" or other extensions

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. SPR-13587 Content-Disposition header causes download in browser for Spring Boot Actuator endpoints

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. SPR-13588 Skip Content-Disposition header when status != 2xx

          • Major - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. SPR-13643 Content-Disposition with fixed file name "f.txt" causes confusion

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Activity

            People

              rstoya05-aop Rossen Stoyanchev
              rstoya05-aop Rossen Stoyanchev
              Archiver:
              tmarshall Trevor Marshall
              Spring Issues Spring Issues

              Dates

                Created:
                Updated:
                Resolved:
                Archived:
                4 years, 20 weeks, 3 days ago