Skip to content
fr Sign in
Not rated

CVE-2022-22976 Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer…

Description

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

Affected products and versions

Product Affected versions Fixed in
Spring Security Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Security

The 10 CVEs of Spring Security →
CVE-2024-22257 In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions… 8.2 High CVE-2023-34042 The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were … 4.1 Medium CVE-2023-34034 Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between… 9.1 Critical CVE-2023-34035 Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to… 7.3 High
Track this CVE