VDB
KO
HIGH 7.5

GHSA-m69x-pw9p-7j3q

Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)

Quick fix

GHSA-m69x-pw9p-7j3q — org.springframework.security:spring-security-saml2-service-provider: upgrade to the fixed version with the command below. 

# pom.xml: bump <version>7.0.6</version> for org.springframework.security:spring-security-saml2-service-provider

Details

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 7.0.0 Fixed in: 7.0.6
Fix # pom.xml: bump <version>7.0.6</version> for org.springframework.security:spring-security-saml2-service-provider
Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 6.5.0 Fixed in: 6.5.11
Fix # pom.xml: bump <version>6.5.11</version> for org.springframework.security:spring-security-saml2-service-provider
Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 6.4.0

No fixed version published yet for org.springframework.security:spring-security-saml2-service-provider (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 6.3.0

No fixed version published yet for org.springframework.security:spring-security-saml2-service-provider (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 5.8.0

No fixed version published yet for org.springframework.security:spring-security-saml2-service-provider (maven). Pin to a known-safe version or switch to an alternative.

Maven / org.springframework.security:spring-security-saml2-service-provider
Introduced in: 0

No fixed version published yet for org.springframework.security:spring-security-saml2-service-provider (maven). Pin to a known-safe version or switch to an alternative.

References