com.github.btheu.settesting:spring (0.1.0), org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4) +10 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.2.2.release)

org.springframework.security:spring-security-core MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.btheu.settesting:spring 0.1.0 -...

at.molindo.social:spring-social-security (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +128 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.2.3.release)

org.springframework.security:spring-security-core MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - at.molindo.social:spring-social-security 1.1.0.releas...

com.cedac.spring.security:spring-security-mongodb (1.0.0), com.foreach.across.modules:admin-web-module (>=1.0.0.release, <=1.1.0.release) +127 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.2.7.release)

org.springframework.security:spring-security-core MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.cedac.spring.security:spring-security-mongodb 1.0...

com.17jee:e-cloud-authorize (3.0.0.release), com.17jee:e-cloud-gateway (>=3.0.0, <=3.0.1.1) +47 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.2.8.release)

org.springframework.security:spring-security-core MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.17jee:e-cloud-authorize 3.0.0.release -...

at.molindo.social:spring-social-security (1.1.4.release), com.foreach.across.modules:admin-web-module (1.1.1.release) +90 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.2.9.release)

org.springframework.security:spring-security-core MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - at.molindo.social:spring-social-security 1.1.4.releas...

org.ff4j:ff4j-security-spring (>=1.0.0, <=1.1.0), org.springframework.security:spring-security-acl (3.0.8.release) +7 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.0.8.release)

org.springframework.security:spring-security-core MAVEN version 3.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.ff4j:ff4j-security-spring =1.0.0, =1.1.0 -...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.github.leleuj.springframework.security:spring-security-oauth-client (>=1.0.0, <=1.1.0) +137 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.1.0.release)

org.springframework.security:spring-security-core MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.ctlok:spring-webmvc-rythm =1.3.6, =1.0.0, =3.0.4,...

org.apache.camel:camel-example-spring-security (>=2.14.0, <=2.14.4), org.apache.camel:camel-spring-security (>=2.14.0, <=2.14.4) +27 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.1.7.release)

org.springframework.security:spring-security-core MAVEN version 3.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.camel:camel-example-spring-security =2.14....

co.paralleluniverse:comsat-spring-security (0.3.0), com.bq.corbel:oauth-server (>=1.31.1, <=1.35.0) +289 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.2.5.release)

org.springframework.security:spring-security-core MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - co.paralleluniverse:comsat-spring-security 0.3.0 -...

cc.ereach:ereach-boot-starter-security (1.0.1), com.ge.predix:uaa-token-lib (>=3.3.2, <=4.0.1) +114 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.2.10.release)

org.springframework.security:spring-security-core MAVEN version 3.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cc.ereach:ereach-boot-starter-security 1.0.1 -...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.github.yongjacky:jee.borneo.miri (1.1.6) +111 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.1.4.release)

org.springframework.security:spring-security-core MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - be.dnsbelgium:rdap-server =0.3.3, =1.6-2, =1.6.0,...

org.springframework.security:spring-security-acl (3.1.5.release), org.springframework.security:spring-security-aspects (3.1.5.release) +7 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.1.5.release)

org.springframework.security:spring-security-core MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl...

com.sitewhere:sitewhere-activemq (>=1.0.2, <=1.4.0), com.sitewhere:sitewhere-azure (>=1.0.2, <=1.4.0) +68 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.2.6.release)

org.springframework.security:spring-security-core MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.sitewhere:sitewhere-activemq =1.0.2, =1.0.2,...

am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3), am.ik.servicebroker:shared-smysql-service-broker (>=0.0.3, <=0.0.5) +1269 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (>=5.0.0.release, <=5.0.15.release)

org.springframework.security:spring-security-core MAVEN version =5.0.0.release, =0.0.2, =0.0.3, =0.0.1, =1.0.1.release, =2.0.0, =1.0.0, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0.release, =3.0.1.release and more Source cves: CVE-2020-5408 Source advisory: OSV:GHSA-2PPP-9496-P23Q...

ai.hyacinth.framework:core-service-gateway-server (0.5.24), au.org.consumerdatastandards:data-holder (>=1.0.0, <=1.12.0) +1448 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (>=5.2.0.release, <=5.2.3.release)

org.springframework.security:spring-security-core MAVEN version =5.2.0.release, =1.0.0, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.9, =0.0.12 - br.com.damsete:logging 0.0.1 - cc.cc4414:cc-spring-auth-server 0.5.1 - cc.cc4414:cc-spring-resource-starter 0.5.1 -...

GHSA-2PPP-9496-P23Q Insufficient Entropy in Spring Security

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has...

org.apache.syncope:syncope-core (>=1.0.9, <=1.1.8), org.springframework.security:spring-security-acl (3.1.6.release) +11 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.1.6.release)

org.springframework.security:spring-security-core MAVEN version 3.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.syncope:syncope-core =1.0.9, =1.4.9, =1.4....

com.github.lrkwz:urlmanaged-locale (0.0.1), com.isotrol.impe3.extensions:impe3-pms-ldap (>=3.0.0, <=3.1.1) +69 more potentially affected by CVE-2020-5408 via org.springframework.security:spring-security-core (3.0.7.release)

org.springframework.security:spring-security-core MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.lrkwz:urlmanaged-locale 0.0.1 -...

Signature wrapping vulnerability in Spring Security

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an...

GHSA-48RW-J489-928M Signature wrapping vulnerability in Spring Security

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an...