CVE-2017-8046: RCE in PATCH requests

January 4, 2018 (updated August 15, 2018)

Malicious PATCH requests submitted to servers using Spring Data REST backed HTTP resources can use specially crafted JSON data to run arbitrary Java code.

References

jira.spring.io/browse/DATAREST-1127
jira.spring.io/browse/DATAREST-1152
pivotal.io/security/cve-2017-8046

Detect and mitigate CVE-2017-8046 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →