CVE-2016-5007

CVE-2016-5007 affects Spring Security (3.2.x, 4.0.x, 4.1.0) and Spring Framework (3.2.x, 4.0.x, 4.1.x, 4.2.x). The root cause is differences in URL pattern matching/space trimming that can cause some paths to be treated as protected when they should not be, due to varying pattern matching between...

CVE-2016-5007

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space...

CVE-2014-0097

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...

PT-2017-5773

Name of the Vulnerable Software and Affected Versions: Spring Security versions 3.1.0 through 3.1.5 Spring Security versions 3.2.0 through 3.2.1 Description: The issue concerns the ActiveDirectoryLdapAuthenticator in Spring Security, which fails to check the password length. This can lead to...

PT-2017-5875

Name of the Vulnerable Software and Affected Versions: Spring Security versions 3.1 through 3.2.4 Description: A malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated, due to the proxy ticket authentication using information from the...

CVE-2014-3527: Improper Authentication

When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...

CVE-2016-5007: Undefined Security Weakness

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space...

PT-2017-8646

Name of the Vulnerable Software and Affected Versions Spring Security versions 3.2.x through 4.1.0 Spring Framework versions 3.2.x through 4.2.x Description The issue arises from differences in the strictness of URL pattern matching mechanisms between Spring Security and the Spring Framework, whi...

CVE-2014-0097: Improper Authentication

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...

PT-2017-8634

Name of the Vulnerable Software and Affected Versions Spring Security OAuth versions 1.0.0 through 1.0.5 Spring Security OAuth versions 2.0.0 through 2.0.9 Description The issue allows a malicious user to trigger remote code execution by crafting the value for the response type parameter, which i...

Security fix for the ALT Linux 7 package samba version 4.5.10-alt1.M70P.1

4.5.10-alt1.M70P.1 built May 25, 2017 Evgeny Sinelnikov in task 183302 May 24, 2017 Evgeny Sinelnikov - Update to second spring security release - Fix longtime initialization bug in ldb proxy - Security fixes: + CVE-2017-7494 Remote code execution from a writable share...

CVE-2016-4977: Undefined Security Weakness

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

Security fix for the ALT Linux 7 package samba-DC version 4.5.7-alt1.M70P.1

March 23, 2017 Evgeny Sinelnikov 4.5.7-alt1.M70P.1 - Update to spring security release - Fixed build --without docs closes: 33118 - Security fixes: + CVE-2017-2619 Symlink race allows access outside share definition...

Security fix for the ALT Linux 7 package samba version 4.5.7-alt1.M70P.1

March 23, 2017 Evgeny Sinelnikov 4.5.7-alt1.M70P.1 - Update to spring security release - Fixed build --without docs closes: 33118 - Security fixes: + CVE-2017-2619 Symlink race allows access outside share definition...

Security fix for the ALT Linux 8 package samba version 4.6.1-alt1

March 23, 2017 Evgeny Sinelnikov 4.6.1-alt1 - Update to spring security release - Fixed build --without docs closes: 33118 - Security fixes: + CVE-2017-2619 Symlink race allows access outside share definition...

CVE-2016-9879

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...

Design/Logic Flaw

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...

CVE-2016-9879

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...

CVE-2016-9879

CVE-2016-9879 affects Spring Security 3.2.x/4.1.x/4.2.x prior to fixed versions. The root cause is how path parameters are handled in the Servlet API: getPathInfo() may include encoded "/" characters, allowing an attacker to bypass security constraints when a request contains a path parameter wit...

CVE-2016-9879

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...