GHSA-cvc6-q2cp-2xhw
Spring Security has Potential Security Misconfiguration when Using withIssuerLocation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-oauth2-jose | >= 6.3.0, <= 6.3.14 | no fix listed |
| Maven | org.springframework.security:spring-security-oauth2-jose | >= 6.4.0, <= 6.4.14 | no fix listed |
| Maven | org.springframework.security:spring-security-oauth2-jose | >= 6.5.0, < 6.5.10 | 6.5.10 |
| Maven | org.springframework.security:spring-security-oauth2-jose | >= 7.0.0, < 7.0.5 | 7.0.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator. This issue affects Spring Security: from 6.3.0 through 6.3.14, from 6.4.0 through 6.4.14, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
References
External links from the advisory. They lead to third-party sites.