VMware Spring Security security vulnerabilities

VMware Spring Security is a set of security frameworks from VMware that provide illustrative security protections for Spring-based applications. A security vulnerability exists in Spring Data REST that stems from the additional disclosure of HTTP resources under the uri for custom controller...

in alovoa/alovoa

✍️ Description Affected versions of this package are vulnerable to XML External Entity XXE Injection via the SAML2AssertionValidator method. Access to external entities was not disabled in XML parsing. 🕵️‍♂️ Proof of Concept org.springframework.security spring-security-oauth2-client...

Spring Security Uncontrolled Resource Consumption

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures by initiating authentication requests, thereby providing...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +100 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.2.0.release, <=5.2.9.release)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.2.0.release, =2.0.0, =1.0.0, =5.0.0, =0.0.3, =0.1.0, =0.1.0, =0.2, =0.2, =0.3 and more Source cves: CVE-2021-22119 Source advisory: OSV:GHSA-W9JG-GVGR-354M...

ai.hyacinth.framework:core-service-gateway-server (0.5.24), au.org.consumerdatastandards:data-holder (>=1.0.0, <=1.12.0) +1741 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-core (>=5.2.0.release, <=5.2.10.release)

org.springframework.security:spring-security-core MAVEN version =5.2.0.release, =1.0.0, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.12 - br.com.damsete:logging 0.0.1 - cc.cc4414:cc-spring-auth-server 0.5.1 - cc.cc4414:cc-spring-resource-starter 0.5.1 -...

GHSA-W9JG-GVGR-354M Resource Exhaustion in Spring Security

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker c...

com.azure.spring:azure-spring-boot-starter-active-directory-b2c (3.6.0), com.okta.idx.sdk:okta-idx-java-embedded-sign-in-widget (>=0.1.0-beta.8, <=1.0.0) +18 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (5.5.0)

org.springframework.security:spring-security-oauth2-client MAVEN version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-client and may be impacted: -...

ai.ylyue:yue-library-auth-client (>=j8.2.4.0, <=j11.2.4.0), ai.ylyue:yue-library-auth-service (>=j8.2.4.0, <=j11.2.4.0) +1443 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-core (>=5.4.0, <=5.4.6)

org.springframework.security:spring-security-core MAVEN version =5.4.0, =j8.2.4.0, =j8.2.4.0, =0.1.0-alpha, =0.1.0-alpha, =2.0.3, =2.0.3, =2.0.3, =1.0.0, =0.0.1, =8.1.0.371, =8.1.0.304, =8.1.0.585.9 and more Source cves: CVE-2021-22119 Source advisory: OSV:GHSA-W9JG-GVGR-354M...

cc.vihackerframework:vihacker-auth-starter (>=1.0.4.r, <=1.0.6.r), cc.vihackerframework:vihacker-common-starter (>=1.0.4.r, <=1.0.6.r) +606 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-core (5.5.0)

org.springframework.security:spring-security-core MAVEN version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cc.vihackerframework:vihacker-auth-starter =1.0.4.r, =1.0.4.r...

cc.vihackerframework:vihacker-auth-starter (>=1.0.4.r, <=1.0.6.r), cc.vihackerframework:vihacker-common-starter (>=1.0.4.r, <=1.0.6.r) +606 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-core (5.5.0)

org.springframework.security:spring-security-core MAVEN version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cc.vihackerframework:vihacker-auth-starter =1.0.4.r, =1.0.4.r...

Resource Exhaustion in Spring Security

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service DoS attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker c...

cn.itlym:shoulder-security (0.3), cn.itlym:shoulder-security-code (0.3) +233 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.3.1.release, <=5.3.9.release)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.3.1.release, =3.0.0-beta.1, =2.2.0, =2.0, =1.0.0, =2.3.1, =6.20.1, =6.6.33, =3.0.0.release, =4.0.8.release and more Source cves: CVE-2021-22119 Source advisory: GHSA-W9JG-GVGR-354M...

be.jidoka:jdk-keycloak-admin (>=1.0.0, <=1.1.0), br.com.damsete:logging (0.0.2) +2245 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-core (>=5.3.0.release, <=5.3.9.release)

org.springframework.security:spring-security-core MAVEN version =5.3.0.release, =1.0.0, =1.0.1, =5.2.1, =5.2.1, =0.5.0.release, =0.0.1, =0.0.3, =0.0.3, =0.0.3, =0.0.4 and more Source cves: CVE-2021-22119 Source advisory: GHSA-W9JG-GVGR-354M...

cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory (3.1.0.release), cloud.altemista.fwk.azure:cloud-altemistafwk-core-azure-active-directory-conf (3.1.0.release) +100 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.2.0.release, <=5.2.9.release)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.2.0.release, =2.0.0, =1.0.0, =5.0.0, =0.0.3, =0.1.0, =0.1.0, =0.2, =0.2, =0.3 and more Source cves: CVE-2021-22119 Source advisory: GHSA-W9JG-GVGR-354M...

cn.itlym:shoulder-security (0.3), cn.itlym:shoulder-security-code (0.3) +233 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.3.1.release, <=5.3.9.release)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.3.1.release, =3.0.0-beta.1, =2.2.0, =2.0, =1.0.0, =2.3.1, =6.20.1, =6.6.33, =3.0.0.release, =4.0.8.release and more Source cves: CVE-2021-22119 Source advisory: OSV:GHSA-W9JG-GVGR-354M...

ai.hyacinth.framework:core-service-gateway-server (0.5.24), au.org.consumerdatastandards:data-holder (>=1.0.0, <=1.12.0) +1741 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-core (>=5.2.0.release, <=5.2.10.release)

org.springframework.security:spring-security-core MAVEN version =5.2.0.release, =1.0.0, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.12 - br.com.damsete:logging 0.0.1 - cc.cc4414:cc-spring-auth-server 0.5.1 - cc.cc4414:cc-spring-resource-starter 0.5.1 -...

ai.ylyue:yue-library-auth-client (>=j8.2.4.0, <=j11.2.4.0), ai.ylyue:yue-library-auth-service (>=j8.2.4.0, <=j11.2.4.0) +1443 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-core (>=5.4.0, <=5.4.6)

org.springframework.security:spring-security-core MAVEN version =5.4.0, =j8.2.4.0, =j8.2.4.0, =0.1.0-alpha, =0.1.0-alpha, =2.0.3, =2.0.3, =2.0.3, =1.0.0, =0.0.1, =8.1.0.371, =8.1.0.304, =8.1.0.585.9 and more Source cves: CVE-2021-22119 Source advisory: GHSA-W9JG-GVGR-354M...

com.azure.spring:azure-spring-boot-starter-active-directory-b2c (>=3.3.0, <=3.5.0), com.backbase.oss:scdf-maven-plugin (0.2.0) +114 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.4.0, <=5.4.6)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.4.0, =3.3.0, =2.4.1, =1.12, =1.18.1, =1.12, =1.12, =1.12, =1.12.1, =0.1.0-beta.6, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5...

be.jidoka:jdk-keycloak-admin (>=1.0.0, <=1.1.0), br.com.damsete:logging (0.0.2) +2245 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-core (>=5.3.0.release, <=5.3.9.release)

org.springframework.security:spring-security-core MAVEN version =5.3.0.release, =1.0.0, =1.0.1, =5.2.1, =5.2.1, =0.5.0.release, =0.0.1, =0.0.3, =0.0.3, =0.0.3, =0.0.4 and more Source cves: CVE-2021-22119 Source advisory: OSV:GHSA-W9JG-GVGR-354M...

com.azure.spring:azure-spring-boot-starter-active-directory-b2c (>=3.3.0, <=3.5.0), com.backbase.oss:scdf-maven-plugin (0.2.0) +114 more potentially affected by CVE-2021-22119 via org.springframework.security:spring-security-oauth2-client (>=5.4.0, <=5.4.6)

org.springframework.security:spring-security-oauth2-client MAVEN version =5.4.0, =3.3.0, =2.4.1, =1.12, =1.18.1, =1.12, =1.12, =1.12, =1.12.1, =0.1.0-beta.6, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5...