GHSA-2ppp-9496-p23q
Insufficient Entropy in Spring Security
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 5.3.0, < 5.3.2 | 5.3.2 |
| Maven | org.springframework.security:spring-security-core | >= 5.2.0, < 5.2.4 | 5.2.4 |
| Maven | org.springframework.security:spring-security-core | >= 5.1.0, < 5.1.10 | 5.1.10 |
| Maven | org.springframework.security:spring-security-core | >= 5.0.0, < 5.0.16 | 5.0.16 |
| Maven | org.springframework.security:spring-security-core | < 4.2.16 | 4.2.16 |
Details
As written in the advisory (Markdown source, shown as plain text).
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
References
External links from the advisory. They lead to third-party sites.