Database Management
Why SolarWinds DPA is not affected by CVE-2024-38808 or CVE-2024-38809
This article explains why SolarWinds Database Performance Monitor (DPA) is not affected by two vulnerabilities in the Spring Framework.
First published date
Last published date
Overview
In 2024, the National Institute of Standards and Technology (NIST) published the following security bulletins about vulnerabilities in the Spring Framework:
-
In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Specifically, an application is vulnerable when the application evaluates user-supplied SpEL expressions.
-
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Affected Spring Framework versions include 6.1.0 - 6.1.11, 6.0.0 - 6.0.22, 5.3.0 - 5.3.37, and older, unsupported versions.
The vulnerabilities described in these CVEs impact numerous software companies.
Product section
Cause
Resolution
CVE-2024-38808 applies only to applications that evaluate user-supplied SpEL expressions. DPA does not do this, and the DPA codebase does not include the common classes required to parse these expressions. DPA uses the Spring expression language in XML files to evaluate roles assigned to the user for authorization purposes. Therefore, DPA is not vulnerable to this CVE.
CVE-2024-38809 applies only to applications that parse ETags from "If-Match" or "If-Non-Match" request headers. To enable ETag support in an application, org.springframework.web.filter.ShallowEtagHeaderFilter must be included in the web.xml file. DPA does not use ETags and does not include this filter. Therefore, DPA is not vulnerable to this CVE.