GHSA-hh32-7344-cg2f
Authorization bypass in Spring Security
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 5.5.0, < 5.5.7 | 5.5.7 |
| Maven | org.springframework.security:spring-security-core | >= 5.6.0, < 5.6.4 | 5.6.4 |
| Maven | org.springframework.security:spring-security-core | < 5.4.11 | 5.4.11 |
| Maven | org.springframework.security:spring-security-web | >= 5.5.0, < 5.5.7 | 5.5.7 |
| Maven | org.springframework.security:spring-security-web | >= 5.6.0, < 5.6.4 | 5.6.4 |
| Maven | org.springframework.security:spring-security-web | < 5.4.11 | 5.4.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-22978
- https://github.com/anchore/grype/issues/2158
- https://github.com/spring-projects/spring-security
- https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMat…
- https://security.netapp.com/advisory/ntap-20220707-0003
- https://spring.io/security/cve-2022-22978
- https://tanzu.vmware.com/security/cve-2022-22978
- https://www.oracle.com/security-alerts/cpujul2022.html