In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled. Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.
| Vendor | Product | Versions |
|---|---|---|
| broadcom | spring_cloud_sleuth | 3.1.0, 3.1.13 |
Updated vendor to Vmware, product name, affected versions to include 3.1.13, changed severity to MEDIUM, and noted no exploit available.
Added affected versions for Cloud Sleuth and marked exploit availability and active exploitation status as true.
Initial creation
