org.springframework.security:spring-security-oauth2-jose 5.1.1.RELEASE

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.security:spring-security-oauth2-jose package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Insufficient Verification of Data Authenticity org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the `withIssuerLocation` component. An attacker can bypass intended security restrictions by exploiting improper configuration of JWT decoding when a separate `OAuth2TokenValidator` is not set. How to fix Insufficient Verification of Data Authenticity? Upgrade `org.springframework.security:spring-security-oauth2-jose` to version 6.5.10, 7.0.5 or higher.	[,6.5.10)[7.0.0-M1,7.0.5)
M Authorization Bypass org.springframework.security:spring-security-oauth2-jose provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Authorization Bypass via the JWT issuer validator. An attacker could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issue. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. How to fix Authorization Bypass? Upgrade org.springframework.security:spring-security-oauth2-jose to version 5.1.2.RELEASE or higher.	[5.1.0,5.1.2.RELEASE)

Vulnerability

Vulnerable Version

Insufficient Verification of Data Authenticity

org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the withIssuerLocation component. An attacker can bypass intended security restrictions by exploiting improper configuration of JWT decoding when a separate OAuth2TokenValidator is not set.

How to fix Insufficient Verification of Data Authenticity?

Upgrade org.springframework.security:spring-security-oauth2-jose to version 6.5.10, 7.0.5 or higher.

[,6.5.10)[7.0.0-M1,7.0.5)

Authorization Bypass

org.springframework.security:spring-security-oauth2-jose provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Authorization Bypass via the JWT issuer validator. An attacker could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issue. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-oauth2-jose to version 5.1.2.RELEASE or higher.

[5.1.0,5.1.2.RELEASE)

org.springframework.security:spring-security-oauth2-jose@5.1.1.RELEASE

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically