VDB
Sign up
MEDIUM4.8

GHSA-q3v6-hm2v-pw99

Spring Framework has Authorization Bypass for Case Sensitive Comparisons

Quick fix

GHSA-q3v6-hm2v-pw99 — org.springframework.security:spring-security-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>5.7.14</version> for org.springframework.security:spring-security-core

Details

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.springframework.security:spring-security-core
Introduced in: 0Fixed in: 5.7.14
Fix# pom.xml: bump <version>5.7.14</version> for org.springframework.security:spring-security-core
Maven/org.springframework.security:spring-security-core
Introduced in: 5.8.0Fixed in: 5.8.16
Fix# pom.xml: bump <version>5.8.16</version> for org.springframework.security:spring-security-core
Maven/org.springframework.security:spring-security-core
Introduced in: 6.0.0Fixed in: 6.0.14
Fix# pom.xml: bump <version>6.0.14</version> for org.springframework.security:spring-security-core
Maven/org.springframework.security:spring-security-core
Introduced in: 6.1.0Fixed in: 6.1.12
Fix# pom.xml: bump <version>6.1.12</version> for org.springframework.security:spring-security-core
Maven/org.springframework.security:spring-security-core
Introduced in: 6.2.0Fixed in: 6.2.8
Fix# pom.xml: bump <version>6.2.8</version> for org.springframework.security:spring-security-core
Maven/org.springframework.security:spring-security-core
Introduced in: 6.3.0Fixed in: 6.3.5
Fix# pom.xml: bump <version>6.3.5</version> for org.springframework.security:spring-security-core

References