GHSA-vxf7-qj7q-83fh
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Quick fix
GHSA-vxf7-qj7q-83fh — org.springframework.security:spring-security-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>6.5.10</version> for org.springframework.security:spring-security-coreDetails
Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Are you affected?
Enter the version of the package you're using.
Affected packages
5.7.0No fixed version published yet for org.springframework.security:spring-security-core (maven). Pin to a known-safe version or switch to an alternative.
5.8.0No fixed version published yet for org.springframework.security:spring-security-core (maven). Pin to a known-safe version or switch to an alternative.
6.3.0No fixed version published yet for org.springframework.security:spring-security-core (maven). Pin to a known-safe version or switch to an alternative.
6.4.0No fixed version published yet for org.springframework.security:spring-security-core (maven). Pin to a known-safe version or switch to an alternative.
6.5.0Fixed in: 6.5.10# pom.xml: bump <version>6.5.10</version> for org.springframework.security:spring-security-core7.0.0Fixed in: 7.0.5# pom.xml: bump <version>7.0.5</version> for org.springframework.security:spring-security-core