org.springframework.vault:spring-vault-core@2.1.5.RELEASE vulnerabilities

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when attempting to revoke a Vault batch token.

Specifically, an application is vulnerable when all of the following are true:

1. The authentication mechanism creates Batch tokens

2. Usage of LifecycleAwareSessionManager in an imperative-only arrangement

3. LifecycleAwareSessionManager.destroy() is called by the application or the application shutdown hook

4. The logging level for LifecycleAwareSessionManager or org.springframework.vault.authentication is set at least to WARN or a more detailed logging level.

5. The token revocation fails because either of:

• A vault error response that batch tokens cannot be revoked
• An I/O error occurs

An application is not vulnerable if any of the following is true:

1. The application uses ReactiveSessionManager in a mixed reactive/imperative or reactive-only arrangement

2. LifecycleAwareSessionManager.destroy() is never called by the application or the application shutdown hook

3. The logging level for LifecycleAwareSessionManager or org.springframework.vault.authentication is set to ERROR or higher, such as OFF

4. The authentication mechanism creates Service tokens

Upgrade org.springframework.vault:spring-vault-core to version 2.3.3, 3.0.2 or higher.