GHSA-HH32-7344-CG2F Authorization bypass in Spring Security

In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.2, <=0.1.6) +5221 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (>=5.0.0.release, <=5.4.10)

org.springframework.security:spring-security-core MAVEN version =5.0.0.release, =4.4.0.0, =0.1.2, =0.5.0, =j8.2.4.0, =j8.2.4.0, =0.0.2, =0.0.3, =0.0.5 - au.net.causal.shoelaces:shoelaces-apphome-integration-tests-common 2.0 - au.net.causal.shoelaces:shoelaces-assorted-integration-tests-common 2.0...

com.allanditzel:spring-security-csrf-token-filter (1.1), com.btmatthews.atlas:atlas-jcr (1.0.1) +140 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.2.0.release)

org.springframework.security:spring-security-core MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.allanditzel:spring-security-csrf-token-filter 1.1...

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +34 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.4.release)

org.springframework.security:spring-security-web MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

co.paralleluniverse:comsat-spring-security (0.3.0), com.bq.corbel:oauth-server (>=1.31.1, <=1.35.0) +231 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.5.release)

org.springframework.security:spring-security-web MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - co.paralleluniverse:comsat-spring-security 0.3.0 -...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), com.atlassian.asap:asap-server-spring-security (>=2.21.8, <=2.21.9) +119 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.11.release)

org.springframework.security:spring-security-core MAVEN version 4.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - au.org.consumerdatastandards:client-cli =1.1.1,...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-acl (3.0.1.release) +13 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.0.1.release)

org.springframework.security:spring-security-core MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

com.cloudseal.client:cloudseal-spring-extension (>=1.2.1, <=1.2.7), com.cloudseal.client:spring-example (>=1.2.1, <=1.2.7) +135 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.1.3.release)

org.springframework.security:spring-security-web MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.cloudseal.client:cloudseal-spring-extension =1.2.1,...

at.researchstudio.sat:won-cryptography (0.3), at.researchstudio.sat:won-matcher (0.3) +1122 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.3.release)

org.springframework.security:spring-security-core MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - at.researchstudio.sat:won-cryptography 0.3 -...

cn.bestwu:security-oauth2-authorizationserver (1.0.1), cn.dceast.platform:platform-security-starter (2.2.3) +526 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.1.3.release)

org.springframework.security:spring-security-core MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cn.bestwu:security-oauth2-authorizationserver 1.0.1 -...

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +48 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.2.4.release)

org.springframework.security:spring-security-core MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

com.github.dblock.waffle:waffle-spring-security2 (>=1.5, <=1.6), com.microsoftopentechnologies:azure-slave (>=0.1.0, <=0.3.0) +201 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (2.0.7.release)

org.springframework.security:spring-security-core MAVEN version 2.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security2 =1.5...

africa.absa:inception-oauth2-resource-server (>=1.0.0, <=1.2.0), au.org.consumerdatastandards:client-cli (>=1.13.0, <=2.4.1) +1257 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=5.5.0, <=5.5.6)

org.springframework.security:spring-security-web MAVEN version =5.5.0, =1.0.0, =1.13.0, =1.13.0, =1.0.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.4.r, =1.0.4.r, =1.0.4.r, =1.0.4.r, =1.7.26, =1.3.30, =1.1.1-alpha, =1.1.1-alpha, =0.0.3-alpha, =0.0.4-alpha-5 and more Source cves: CVE-2022-22978 Source...

co.paralleluniverse:comsat-spring-security (0.3.0), com.bq.corbel:oauth-server (>=1.31.1, <=1.35.0) +289 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.2.5.release)

org.springframework.security:spring-security-core MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - co.paralleluniverse:comsat-spring-security 0.3.0 -...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-cas-client (3.0.1.release) +8 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.0.1.release)

org.springframework.security:spring-security-web MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.ylyue:yue-library-auth-client (j11.2.6.0) +1310 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=5.6.0, <=5.6.3)

org.springframework.security:spring-security-web MAVEN version =5.6.0, =4.4.0.2, =0.2.0, =2.1.0.m8, =1.0.0, =2.7.0.beta4, =2.7.0.beta4, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta3, =2.7.0.beta1, =2.7.0.beta1, =2.7.0.beta2 and more Source cves: CVE-2022-22978 Source advisory:...

com.arsframework:ars-module-cms (>=1.0.0, <=1.1.4), com.arsframework:ars-module-educate (>=1.0.0, <=1.1.0) +186 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.1.3.release)

org.springframework.security:spring-security-core MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.arsframework:ars-module-cms =1.0.0, =1.0.0, =1.0....

com.github.jackpanz:maccloud-core (>=2.4.7, <=2.4.8), com.gwtincubator:gwt-incubator-security (1.0.1) +74 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (2.0.4)

org.springframework.security:spring-security-core MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.jackpanz:maccloud-core =2.4.7, =1.1-1, =1.1-2 -...

org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4), org.springframework.security:spring-security-cas (3.2.2.release) +3 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.2.2.release)

org.springframework.security:spring-security-web MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.pac4j:spring-security-pac4j =1.2.3, =1.2.4 -...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.27-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.27-release) +99 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.0.release)

org.springframework.security:spring-security-core MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-releas...