springframework: BCrypt skips salt rounds for work factor of 31

🗓️ 07 Jul 2022 14:19:49Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 1 Views

Flaw in Spring Framework BCrypt causes no salt rounds at work factor thirty one due to overflow.

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring Security affects IBM Process Mining . Multiple CVEs	27 Jun 202311:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities Spring Boot, Spring Security and Spring Framework might affect IBM Storage Copy Data Management	22 Mar 202416:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Spring Security	17 May 202319:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Log4j 1.x	3 Aug 202216:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2023	1 Sep 202319:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities	11 Jul 202216:00	–	ibm
ATTACKERKB	CVE-2022-22976	19 May 202215:15	–	attackerkb
Circl	CVE-2022-22976	19 May 202218:29	–	circl
CNNVD	Spring Framework 输入验证错误漏洞	17 May 202200:00	–	cnnvd
CVE	CVE-2022-22976	19 May 202214:50	–	cve

Vulners

Node

redhat jboss_fuseRange<7

AND

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-22976
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-22976
tanzu	www.tanzu.vmware.com/security/cve-2022-22976
cve	www.cve.org/CVERecord

07 Jul 2026 09:23Current

7.4High risk

Vulners AI Score7.4

CVSS 24.3

CVSS 3.15.3

EPSS0.02139

Spring Framework password hashing work factor integer overflow security flaw