Upgrade Spring to 5.3.38 to fix CVE-2024-38809

[damoasis]

Describe the bug
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.

Desktop (please complete the following information):

• OS: Centos
• version: nacos-server 2.4.1

Additional context
Spring官方链接

Affected Spring Products and Versions

Spring Framework

• 6.1.0 - 6.1.11
• 6.0.0 - 6.0.22
• 5.3.0 - 5.3.37
• Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)	Fix version	Availability
6.1.x	6.1.12	OSS
6.0.x	6.0.23	OSS
5.3.x	5.3.38	OSS

No other mitigation steps are necessary.

Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.

Credit

This issue was responsibly reported by Seokchan Yoon.

History

• 2024-08-14: Initial vulnerability report published.