Homepage

Improper Verification of Cryptographic Signature The advisory has been revoked - it doesn't affect any version of package libspring-security-2.0-java  (opens in a new tab)

Threat Intelligence

EPSS
1.2% (65th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN8-LIBSPRINGSECURITY20JAVA-569225
  • published18 May 2020
  • disclosed13 May 2020
Report a new vulnerability Found a mistake?

Introduced: 13 May 2020

CVE-2020-5407  (opens in a new tab)
CWE-347  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libspring-security-2.0-java package and not the libspring-security-2.0-java package as distributed by Debian.

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.

References