~ / search / GHSA-x637-x8p3-5p22

GHSA-x637-x8p3-5p22

Improper Authentication in Spring Authorization Server

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-22258

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework.security:spring-security-oauth2-authorization-server < 1.1.6 1.1.6
Maven org.springframework.security:spring-security-oauth2-authorization-server >= 1.2.0, < 1.2.3 1.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

References

External links from the advisory. They lead to third-party sites.