Signature wrapping vulnerability in Spring Security

2020-06-0516:13:29

Google

osv.dev

0.008 Low

EPSS

Percentile

82.1%

JSON

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.

CPENameOperatorVersion
org.springframework.security:spring-security-coreeq5.3.0.RELEASE
org.springframework.security:spring-security-coreeq5.3.1.RELEASE
org.springframework.security:spring-security-coreeq5.2.3.RELEASE
org.springframework.security:spring-security-coreeq5.2.2.RELEASE
org.springframework.security:spring-security-coreeq5.2.0.RELEASE
org.springframework.security:spring-security-coreeq5.2.1.RELEASE

Name	Operator	Version
org.springframework.security:spring-security-core	eq	5.3.0.RELEASE
org.springframework.security:spring-security-core	eq	5.3.1.RELEASE
org.springframework.security:spring-security-core	eq	5.2.3.RELEASE
org.springframework.security:spring-security-core	eq	5.2.2.RELEASE
org.springframework.security:spring-security-core	eq	5.2.0.RELEASE
org.springframework.security:spring-security-core	eq	5.2.1.RELEASE