Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:39:51 +0000 GHSA-2jrg-rf5x-568g — Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates https://vulnerability.circl.lu/vuln/ghsa-2jrg-rf5x-568g <p><strong>Affected:</strong> Maven: org.springframework.security:spring-security-web</p> <p>Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.</p> <p><strong>Affected:</strong> Maven: org.springframework.security:spring-security-web</p> <p>Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.</p> https://vulnerability.circl.lu/vuln/ghsa-2jrg-rf5x-568g