Non notée
CVE-2022-22976 Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer…
Description
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Security | Versions non publiées |
Références
- tanzu.vmware.com tanzu.vmware.com
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Security
Les 10 CVE de Spring Security →
CVE-2024-22257
In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions…
8.2
Élevée
CVE-2023-34042
The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were …
4.1
Moyenne
CVE-2023-34034
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between…
9.1
Critique
CVE-2023-34035
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to…
7.3
Élevée