Authorization Bypass SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-8399273

[github-actions]

Overview

org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security.

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

Remediation

Upgrade org.springframework.security:spring-security-crypto to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Spring Security Advisory