Deserialization of Untrusted Data in Spring Security

An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by...

GHSA-VHRG-V3CV-P247 Deserialization of Untrusted Data in Spring Security

An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by...

am.ik.home:uaa-client (>=1.3.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.3.0, <=1.9.0) +732 more potentially affected by CVE-2017-4995 via org.springframework.security:spring-security-core (>=4.2.0.release, <=4.2.2.release)

org.springframework.security:spring-security-core MAVEN version =4.2.0.release, =1.3.0, =1.3.0, =1.3.0, =0.2.0, =1.0.3, =1.1.19-release, =1.1.23-release, =1.1.19-release, =1.1.19-release, =1.1.23-release, =1.3.2, =1.3.2, =1.3.2, =1.5.1 and more Source cves: CVE-2017-4995 Source advisory:...

com.aerse:gcless (11.2), com.aerse:spring-security-taglib (1.1) +239 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.2.0.release, <=3.2.1.release)

org.springframework.security:spring-security-core MAVEN version =3.2.0.release, =0.0.1, =3.4, =3.0.0, =1.0.50, =1.0.52 - com.microsoftopentechnologies:windows-azure-storage-plugin 0.3.1 and more Source cves: CVE-2014-0097 Source advisory: OSV:GHSA-GV9V-C375-HVMG...

com.aerse:gcless (11.2), com.aerse:spring-security-taglib (1.1) +239 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.2.0.release, <=3.2.1.release)

org.springframework.security:spring-security-core MAVEN version =3.2.0.release, =0.0.1, =3.4, =3.0.0, =1.0.50, =1.0.52 - com.microsoftopentechnologies:windows-azure-storage-plugin 0.3.1 and more Source cves: CVE-2014-0097 Source advisory: GHSA-GV9V-C375-HVMG...

Improper Authentication in Spring Security

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...

GHSA-GV9V-C375-HVMG Improper Authentication in Spring Security

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.arsframework:ars-module-cms (>=1.0.0, <=1.1.4) +379 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.4.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =0.3.3, =1.0.0, =1.0.0, =1.0.0, =1.2.1, =1.2.1, =1.3.6, =1.0.0-alpha2, =1.5, =1.0.0, =3.0.4, =3.0.5 - com.github.ptomli.bedrock:bedrock-core 1.0.0 - com.github.yongjacky:jee.borneo.miri 1.1.6 -...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.arsframework:ars-module-cms (>=1.0.0, <=1.1.4) +379 more potentially affected by CVE-2014-0097 via org.springframework.security:spring-security-core (>=3.1.0.release, <=3.1.4.release)

org.springframework.security:spring-security-core MAVEN version =3.1.0.release, =0.3.3, =1.0.0, =1.0.0, =1.0.0, =1.2.1, =1.2.1, =1.3.6, =1.0.0-alpha2, =1.5, =1.0.0, =3.0.4, =3.0.5 - com.github.ptomli.bedrock:bedrock-core 1.0.0 - com.github.yongjacky:jee.borneo.miri 1.1.6 -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +19 more potentially affected by CVE-2022-22970 via org.springframework:spring-beans (2.0-m2)

org.springframework:spring-beans MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-beans and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0 - org.acegisecurity:acegi-security-adapter...

This Week in Spring - April 26th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week I was hoping to be in glorious Chicago, Illinois for the first in-person SpringOne Tour installment since the pandemic. But, alas, I couldnt go because - out of an abundance of caution, and since I was exposed to...

Pivotal Spring Security Oauth Resource Management Error Vulnerability

A resource management error vulnerability exists in Pivotal Spring Security OAuth, a login system from Pivotal, Inc. that provides support for adding OAuth1 and OAuth2 functionality to Spring Web applications. The vulnerability stems from improper handling of a large number of message requests. A...

Denial Of Service (DoS)

Spring Security OAuth is vulnerable to denial of service. The vulnerability exists due to a lack of restriction of the number of request initiating the Authorization Request for the Authorization Code Grant allowing an attacker to exhaust the system resources sending multiple requests with a sing...

com.atlassian.connect:atlassian-connect-spring-boot-api (>=2.0.2, <=2.0.7), com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.0.2, <=2.0.7) +35 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.4.0.release, <=2.4.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.4.0.release, =2.0.2, =2.0.2, =2.0.2, =2.0.2, =0.0.5, =0.0.5, =0.0.5, =5.0.0, =5.0.0, =4.59.5, =1.0.10.release, =1.0.10.release, =1.0.10.release, =1.73.8, =1.106.2 and more Source cves: CVE-2022-22969 Source advisory:...

cn.infrabase:infrabase-platform-passport (0.0.1), cn.itlym:shoulder-starter-auth-server (0.6) +263 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.5.0.release, <=2.5.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.5.0.release, =1.1.0, =1.1.0, =1.129.9, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =3.2.1.release, =5.0.0, =1.4.11, =1.4.11, =1.5.7 and more Source cves: CVE-2022-22969 Source advisory: GHSA-C2CP-3XJ9-97W9...

com.atlassian.connect:atlassian-connect-spring-boot-api (>=2.0.2, <=2.0.7), com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.0.2, <=2.0.7) +35 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.4.0.release, <=2.4.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.4.0.release, =2.0.2, =2.0.2, =2.0.2, =2.0.2, =0.0.5, =0.0.5, =0.0.5, =5.0.0, =5.0.0, =4.59.5, =1.0.10.release, =1.0.10.release, =1.0.10.release, =1.73.8, =1.106.2 and more Source cves: CVE-2022-22969 Source advisory:...

cn.infrabase:infrabase-platform-passport (0.0.1), cn.itlym:shoulder-starter-auth-server (0.6) +263 more potentially affected by CVE-2022-22969 via org.springframework.security.oauth:spring-security-oauth2 (>=2.5.0.release, <=2.5.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.5.0.release, =1.1.0, =1.1.0, =1.129.9, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =3.2.1.release, =5.0.0, =1.4.11, =1.4.11, =1.5.7 and more Source cves: CVE-2022-22969 Source advisory: OSV:GHSA-C2CP-3XJ9-97W9...

GHSA-C2CP-3XJ9-97W9 Denial of service in Spring Security OAuth2

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the...

Denial of service in Spring Security OAuth2

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the...

CVE-2022-22969

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the...