Vulnerabilites related to Spring by VMware - Spring Security
cve-2020-5407
Vulnerability from cvelistv5
Published
2020-05-13 17:00
Modified
2024-09-16 23:56
Severity ?
EPSS score ?
Summary
Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.
References
| ▼ | URL | Tags |
|---|---|---|
| https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E | mailing-list, x_refsource_MLIST | |
| https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E | mailing-list, x_refsource_MLIST | |
| https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E | mailing-list, x_refsource_MLIST | |
| https://www.oracle.com/security-alerts/cpuoct2020.html | x_refsource_MISC | |
| https://tanzu.vmware.com/security/cve-2020-5407 | x_refsource_CONFIRM | |
| https://www.oracle.com/security-alerts/cpujan2021.html | x_refsource_MISC | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Spring by VMware | Spring Security |
Version: 5.2 < 5.2.4 Version: 5.3 < 5.3.2 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T08:30:23.906Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "[servicemix-issues] 20200514 [jira] [Created] (SM-4384) Create OSGi bundles for spring-security 5.3.2.RELEASE + 5.1.10.RELEASE", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E", }, { name: "[geode-dev] 20200521 Re: Proposal to backport GEODE-8167", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E", }, { name: "[geode-dev] 20200521 Proposal to backport GEODE-8167", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://tanzu.vmware.com/security/cve-2020-5407", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpujan2021.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuApr2021.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Spring Security", vendor: "Spring by VMware", versions: [ { lessThan: "5.2.4", status: "affected", version: "5.2", versionType: "custom", }, { lessThan: "5.3.2", status: "affected", version: "5.3", versionType: "custom", }, ], }, ], datePublic: "2020-05-13T00:00:00", descriptions: [ { lang: "en", value: "Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-347", description: "CWE-347: Improper Verification of Cryptographic Signature", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-14T17:20:23", orgId: "862b2186-222f-48b9-af87-f1fb7bb26d03", shortName: "pivotal", }, references: [ { name: "[servicemix-issues] 20200514 [jira] [Created] (SM-4384) Create OSGi bundles for spring-security 5.3.2.RELEASE + 5.1.10.RELEASE", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7%40%3Cissues.servicemix.apache.org%3E", }, { name: "[geode-dev] 20200521 Re: Proposal to backport GEODE-8167", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c%40%3Cdev.geode.apache.org%3E", }, { name: "[geode-dev] 20200521 Proposal to backport GEODE-8167", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a%40%3Cdev.geode.apache.org%3E", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://tanzu.vmware.com/security/cve-2020-5407", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpujan2021.html", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuApr2021.html", }, ], source: { discovery: "UNKNOWN", }, title: "Signature Wrapping Vulnerability with spring-security-saml2-service-provider", x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@pivotal.io", DATE_PUBLIC: "2020-05-13T00:00:00.000Z", ID: "CVE-2020-5407", STATE: "PUBLIC", TITLE: "Signature Wrapping Vulnerability with spring-security-saml2-service-provider", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Spring Security", version: { version_data: [ { affected: "<", version_affected: "<", version_name: "5.2", version_value: "5.2.4", }, { affected: "<", version_affected: "<", version_name: "5.3", version_value: "5.3.2", }, ], }, }, ], }, vendor_name: "Spring by VMware", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.", }, ], }, impact: null, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-347: Improper Verification of Cryptographic Signature", }, ], }, ], }, references: { reference_data: [ { name: "[servicemix-issues] 20200514 [jira] [Created] (SM-4384) Create OSGi bundles for spring-security 5.3.2.RELEASE + 5.1.10.RELEASE", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r73af928cf64bebf78b7fa4bc56a5253273ec7829f5f5827f64c72fc7@%3Cissues.servicemix.apache.org%3E", }, { name: "[geode-dev] 20200521 Re: Proposal to backport GEODE-8167", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rd99601fbca514f214f88f9e53fd5be3cfbff05b350c994b4ec2e184c@%3Cdev.geode.apache.org%3E", }, { name: "[geode-dev] 20200521 Proposal to backport GEODE-8167", refsource: "MLIST", url: "https://lists.apache.org/thread.html/ra19a4e7236877fe12bfb52db07b27ad72d9e7a9f5e27bba7e928e18a@%3Cdev.geode.apache.org%3E", }, { name: "https://www.oracle.com/security-alerts/cpuoct2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { name: "https://tanzu.vmware.com/security/cve-2020-5407", refsource: "CONFIRM", url: "https://tanzu.vmware.com/security/cve-2020-5407", }, { name: "https://www.oracle.com/security-alerts/cpujan2021.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpujan2021.html", }, { name: "https://www.oracle.com/security-alerts/cpuApr2021.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuApr2021.html", }, ], }, source: { discovery: "UNKNOWN", }, }, }, }, cveMetadata: { assignerOrgId: "862b2186-222f-48b9-af87-f1fb7bb26d03", assignerShortName: "pivotal", cveId: "CVE-2020-5407", datePublished: "2020-05-13T17:00:15.881645Z", dateReserved: "2020-01-03T00:00:00", dateUpdated: "2024-09-16T23:56:17.066Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2020-5408
Vulnerability from cvelistv5
Published
2020-05-14 17:15
Modified
2024-09-17 01:01
Severity ?
EPSS score ?
Summary
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.oracle.com/security-alerts/cpuoct2020.html | x_refsource_MISC | |
| https://tanzu.vmware.com/security/cve-2020-5408 | x_refsource_CONFIRM | |
| https://www.oracle.com/security-alerts/cpujan2021.html | x_refsource_MISC | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Spring by VMware | Spring Security |
Version: 4.2 < 4.2.16 Version: 5.0 < 5.0.16 Version: 5.1 < 5.1.10 Version: 5.2 < 5.2.4 Version: 5.3 < 5.3.2 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T08:30:23.986Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://tanzu.vmware.com/security/cve-2020-5408", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpujan2021.html", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuApr2021.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Spring Security", vendor: "Spring by VMware", versions: [ { lessThan: "4.2.16", status: "affected", version: "4.2", versionType: "custom", }, { lessThan: "5.0.16", status: "affected", version: "5.0", versionType: "custom", }, { lessThan: "5.1.10", status: "affected", version: "5.1", versionType: "custom", }, { lessThan: "5.2.4", status: "affected", version: "5.2", versionType: "custom", }, { lessThan: "5.3.2", status: "affected", version: "5.3", versionType: "custom", }, ], }, ], datePublic: "2020-05-13T00:00:00", descriptions: [ { lang: "en", value: "Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-329", description: "CWE-329: Not Using a Random IV with CBC Mode", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-14T17:20:23", orgId: "862b2186-222f-48b9-af87-f1fb7bb26d03", shortName: "pivotal", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://tanzu.vmware.com/security/cve-2020-5408", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpujan2021.html", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuApr2021.html", }, ], source: { discovery: "UNKNOWN", }, title: "Dictionary attack with Spring Security queryable text encryptor", x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@pivotal.io", DATE_PUBLIC: "2020-05-13T00:00:00.000Z", ID: "CVE-2020-5408", STATE: "PUBLIC", TITLE: "Dictionary attack with Spring Security queryable text encryptor", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Spring Security", version: { version_data: [ { affected: "<", version_affected: "<", version_name: "4.2", version_value: "4.2.16", }, { affected: "<", version_affected: "<", version_name: "5.0", version_value: "5.0.16", }, { affected: "<", version_affected: "<", version_name: "5.1", version_value: "5.1.10", }, { affected: "<", version_affected: "<", version_name: "5.2", version_value: "5.2.4", }, { affected: "<", version_affected: "<", version_name: "5.3", version_value: "5.3.2", }, ], }, }, ], }, vendor_name: "Spring by VMware", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.", }, ], }, impact: null, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "CWE-329: Not Using a Random IV with CBC Mode", }, ], }, ], }, references: { reference_data: [ { name: "https://www.oracle.com/security-alerts/cpuoct2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuoct2020.html", }, { name: "https://tanzu.vmware.com/security/cve-2020-5408", refsource: "CONFIRM", url: "https://tanzu.vmware.com/security/cve-2020-5408", }, { name: "https://www.oracle.com/security-alerts/cpujan2021.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpujan2021.html", }, { name: "https://www.oracle.com/security-alerts/cpuApr2021.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuApr2021.html", }, ], }, source: { discovery: "UNKNOWN", }, }, }, }, cveMetadata: { assignerOrgId: "862b2186-222f-48b9-af87-f1fb7bb26d03", assignerShortName: "pivotal", cveId: "CVE-2020-5408", datePublished: "2020-05-14T17:15:13.256026Z", dateReserved: "2020-01-03T00:00:00", dateUpdated: "2024-09-17T01:01:47.960Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }