VDB
KO
LOW 3.7

GHSA-ww38-37g9-m3q3

Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads

Quick fix

GHSA-ww38-37g9-m3q3 — org.springframework.security:spring-security-saml2-service-provider: upgrade to the fixed version with the command below. 

# pom.xml: bump <version>7.0.6</version> for org.springframework.security:spring-security-saml2-service-provider

Details

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 7.0.0 Fixed in: 7.0.6
Fix # pom.xml: bump <version>7.0.6</version> for org.springframework.security:spring-security-saml2-service-provider
Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 6.5.0 Fixed in: 6.5.11
Fix # pom.xml: bump <version>6.5.11</version> for org.springframework.security:spring-security-saml2-service-provider
Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 6.4.0

No fixed version published yet for org.springframework.security:spring-security-saml2-service-provider (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 6.3.0

No fixed version published yet for org.springframework.security:spring-security-saml2-service-provider (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 5.8.0

No fixed version published yet for org.springframework.security:spring-security-saml2-service-provider (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 0

No fixed version published yet for org.springframework.security:spring-security-saml2-service-provider (maven). Pin to a known-safe version or switch to an alternative.

References