Integer Overflow or Wraparound Affecting org.springframework.security:spring-security-core package, versions [3.1.0.RELEASE,5.4.11)


Severity

0.0
medium
0
10

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.15% (52nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-5950401
  • published 18 May 2022
  • disclosed 18 May 2022
  • credit Eyal Kaspi

How to fix?

Upgrade org.springframework.security:spring-security-core to version 5.4.11 or higher.

Overview

org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound when using the BCrypt class with the maximum work factor (31). In such a case, the encoder does not perform any salt rounds due to the overflow.

Note:

The default settings are not affected by this CVE.

CVSS Scores

version 3.1
Expand this section

Snyk

5.3 medium
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    High
  • User Interaction (UI)
    None
  • Scope (S)
    Changed
  • Confidentiality (C)
    High
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

NVD

5.3 medium
Expand this section

Red Hat

5.3 medium