Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

spring-boot-starter-security-2.7.1.jar: 6 vulnerabilities (highest severity is: 9.8) reachable #5

Open
mend-for-github-com bot opened this issue Sep 22, 2023 · 0 comments
Open

spring-boot-starter-security-2.7.1.jar: 6 vulnerabilities (highest severity is: 9.8) reachable #5

mend-for-github-com bot opened this issue Sep 22, 2023 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link

mend-for-github-com bot commented Sep 22, 2023 •
edited
Loading

Vulnerable Library - spring-boot-starter-security-2.7.1.jar

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-core/5.7.2/spring-security-core-5.7.2.jar

Found in HEAD commit: 2ff65424c48b6f26c40b741a18dfe5db8d9c8841

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (spring-boot-starter-security version) Remediation Possible** Reachability
CVE-2022-31692 Critical 9.8 Not Defined 0.1% spring-security-web-5.7.2.jar Transitive 2.7.6 ✅

Reachable
CVE-2023-34034 Critical 9.1 Not Defined 0.2% spring-security-config-5.7.2.jar Transitive 2.7.14 ✅

Reachable
CVE-2024-22257 High 8.2 Not Defined 0.0% spring-security-core-5.7.2.jar Transitive 3.0.0 ✅

Reachable
CVE-2023-20862 Medium 6.3 Not Defined 0.1% spring-security-web-5.7.2.jar Transitive 2.7.12 ✅

Reachable
CVE-2024-38821 Critical 9.1 Not Defined 0.0% spring-security-web-5.7.2.jar Transitive 3.0.0 ✅

Unreachable
CVE-2024-38827 Medium 4.8 Not Defined 0.0% detected in multiple dependencies Transitive 3.0.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-31692

Vulnerable Library - spring-security-web-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/5.7.2/spring-security-web-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • ❌ spring-security-web-5.7.2.jar (Vulnerable Library)

Found in HEAD commit: 2ff65424c48b6f26c40b741a18dfe5db8d9c8841

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.webgoat.webwolf.WebSecurityConfig (Application)
  -> org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$1 (Extension)
   -> org.springframework.security.config.annotation.web.builders.WebSecurity (Extension)
    -> ❌ org.springframework.security.web.access.intercept.AuthorizationFilter (Vulnerable Component)

Vulnerability Details

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)

Publish Date: 2022-10-31

URL: CVE-2022-31692

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tanzu.vmware.com/security/cve-2022-31692

Release Date: 2022-10-31

Fix Resolution (org.springframework.security:spring-security-web): 5.7.5

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.7.6

In order to enable automatic remediation, please create workflow rules

CVE-2023-34034

Vulnerable Library - spring-security-config-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/5.7.2/spring-security-config-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • ❌ spring-security-config-5.7.2.jar (Vulnerable Library)

Found in HEAD commit: 2ff65424c48b6f26c40b741a18dfe5db8d9c8841

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.webgoat.container.WebSecurityConfig (Application)
  -> org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer (Extension)
   -> org.springframework.security.config.annotation.web.configurers.AbstractConfigAttributeRequestMatcherRegistry (Extension)
    -> ❌ org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry (Vulnerable Component)

Vulnerability Details

Using "**" as a pattern in Spring Security configuration
for WebFlux creates a mismatch in pattern matching between Spring
Security and Spring WebFlux, and the potential for a security bypass.

Publish Date: 2023-07-19

URL: CVE-2023-34034

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-34034

Release Date: 2023-07-19

Fix Resolution (org.springframework.security:spring-security-config): 5.7.10

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.7.14

In order to enable automatic remediation, please create workflow rules

CVE-2024-22257

Vulnerable Library - spring-security-core-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-core/5.7.2/spring-security-core-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • spring-security-config-5.7.2.jar
      • ❌ spring-security-core-5.7.2.jar (Vulnerable Library)

Found in HEAD commit: 2ff65424c48b6f26c40b741a18dfe5db8d9c8841

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.webgoat.webwolf.WebSecurityConfig (Application)
  -> org.springframework.security.config.annotation.web.builders.HttpSecurity (Extension)
   -> org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$AuthorizationManagerRequestMatcherRegistry (Extension)
    -> org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$AuthorizedUrl (Extension)
     -> ❌ org.springframework.security.authorization.AuthenticatedAuthorizationManager (Vulnerable Component)

Vulnerability Details

In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8,
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.

Publish Date: 2024-03-18

URL: CVE-2024-22257

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-22257

Release Date: 2024-03-18

Fix Resolution (org.springframework.security:spring-security-core): 5.7.12

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.0.0

In order to enable automatic remediation, please create workflow rules

CVE-2023-20862

Vulnerable Library - spring-security-web-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/5.7.2/spring-security-web-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • ❌ spring-security-web-5.7.2.jar (Vulnerable Library)

Found in HEAD commit: 2ff65424c48b6f26c40b741a18dfe5db8d9c8841

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

org.owasp.webgoat.webwolf.WebSecurityConfig (Application)
  -> org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter (Extension)
   -> org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer (Extension)
    -> ❌ org.springframework.security.web.session.DisableEncodeUrlFilter (Vulnerable Component)

Vulnerability Details

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.

Publish Date: 2023-04-19

URL: CVE-2023-20862

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2023-20862

Release Date: 2023-04-19

Fix Resolution (org.springframework.security:spring-security-web): 5.7.8

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.7.12

In order to enable automatic remediation, please create workflow rules

CVE-2024-38821

Vulnerable Library - spring-security-web-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/5.7.2/spring-security-web-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • ❌ spring-security-web-5.7.2.jar (Vulnerable Library)

Found in HEAD commit: 2ff65424c48b6f26c40b741a18dfe5db8d9c8841

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances.
For this to impact an application, all of the following must be true: It must be a WebFlux application, It must be using Spring's static resources support, and it must have a non-permitAll authorization rule applied to the static resources support.

Publish Date: 2024-10-28

URL: CVE-2024-38821

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-38821

Release Date: 2024-10-28

Fix Resolution (org.springframework.security:spring-security-web): 5.7.13

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.0.0

In order to enable automatic remediation, please create workflow rules

CVE-2024-38827

Vulnerable Libraries - spring-security-config-5.7.2.jar, spring-security-core-5.7.2.jar, spring-security-crypto-5.7.2.jar, spring-security-web-5.7.2.jar

spring-security-config-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-config/5.7.2/spring-security-config-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • ❌ spring-security-config-5.7.2.jar (Vulnerable Library)

spring-security-core-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-core/5.7.2/spring-security-core-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • spring-security-config-5.7.2.jar
      • ❌ spring-security-core-5.7.2.jar (Vulnerable Library)

spring-security-crypto-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-crypto/5.7.2/spring-security-crypto-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • spring-security-config-5.7.2.jar
      • spring-security-core-5.7.2.jar
        • ❌ spring-security-crypto-5.7.2.jar (Vulnerable Library)

spring-security-web-5.7.2.jar

Spring Security

Library home page: https://spring.io

Path to dependency file: /pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/security/spring-security-web/5.7.2/spring-security-web-5.7.2.jar

Dependency Hierarchy:

  • spring-boot-starter-security-2.7.1.jar (Root Library)
    • ❌ spring-security-web-5.7.2.jar (Vulnerable Library)

Found in HEAD commit: 2ff65424c48b6f26c40b741a18dfe5db8d9c8841

Found in base branch: main

Vulnerability Details

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly.

Publish Date: 2024-12-02

URL: CVE-2024-38827

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (4.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://spring.io/security/cve-2024-38827

Release Date: 2024-12-02

Fix Resolution (org.springframework.security:spring-security-config): 5.7.14

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.0.0

Fix Resolution (org.springframework.security:spring-security-core): 5.7.14

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.0.0

Fix Resolution (org.springframework.security:spring-security-crypto): 5.7.14

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 2.7.2

Fix Resolution (org.springframework.security:spring-security-web): 5.7.14

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-security): 3.0.0

In order to enable automatic remediation, please create workflow rules

In order to enable automatic remediation for this issue, please create workflow rules
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Sep 22, 2023
@mend-for-github-com mend-for-github-com bot changed the title spring-boot-starter-security-2.7.1.jar: 3 vulnerabilities (highest severity is: 9.8) spring-boot-starter-security-2.7.1.jar: 3 vulnerabilities (highest severity is: 9.8) reachable Sep 26, 2023
@mend-for-github-com mend-for-github-com bot changed the title spring-boot-starter-security-2.7.1.jar: 3 vulnerabilities (highest severity is: 9.8) reachable spring-boot-starter-security-2.7.1.jar: 4 vulnerabilities (highest severity is: 9.8) reachable Mar 19, 2024
@mend-for-github-com mend-for-github-com bot changed the title spring-boot-starter-security-2.7.1.jar: 4 vulnerabilities (highest severity is: 9.8) reachable spring-boot-starter-security-2.7.1.jar: 5 vulnerabilities (highest severity is: 9.8) reachable Oct 23, 2024
@mend-for-github-com mend-for-github-com bot changed the title spring-boot-starter-security-2.7.1.jar: 5 vulnerabilities (highest severity is: 9.8) reachable spring-boot-starter-security-2.7.1.jar: 6 vulnerabilities (highest severity is: 9.8) reachable Nov 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants