GHSA-mqvr-2rp8-j7h4
Spring LDAP data exposure vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.ldap:spring-ldap-core | >= 3.0.0, < 3.2.8 | 3.2.8 |
| Maven | org.springframework.ldap:spring-ldap-core | < 2.4.4 | 2.4.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.
The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried
Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820
References
External links from the advisory. They lead to third-party sites.