VDB
Sign up
LOW3.7

GHSA-vxf7-qj7q-83fh

Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

Quick fix

GHSA-vxf7-qj7q-83fh — org.springframework.security:spring-security-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>6.5.10</version> for org.springframework.security:spring-security-core

Details

Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.springframework.security:spring-security-core
Introduced in: 5.7.0

No fixed version published yet for org.springframework.security:spring-security-core (maven). Pin to a known-safe version or switch to an alternative.

Maven/org.springframework.security:spring-security-core
Introduced in: 5.8.0

No fixed version published yet for org.springframework.security:spring-security-core (maven). Pin to a known-safe version or switch to an alternative.

Maven/org.springframework.security:spring-security-core
Introduced in: 6.3.0

No fixed version published yet for org.springframework.security:spring-security-core (maven). Pin to a known-safe version or switch to an alternative.

Maven/org.springframework.security:spring-security-core
Introduced in: 6.4.0

No fixed version published yet for org.springframework.security:spring-security-core (maven). Pin to a known-safe version or switch to an alternative.

Maven/org.springframework.security:spring-security-core
Introduced in: 6.5.0Fixed in: 6.5.10
Fix# pom.xml: bump <version>6.5.10</version> for org.springframework.security:spring-security-core
Maven/org.springframework.security:spring-security-core
Introduced in: 7.0.0Fixed in: 7.0.5
Fix# pom.xml: bump <version>7.0.5</version> for org.springframework.security:spring-security-core

References