| Package | Affected versions | Patched versions |
|---|---|---|
| org.springframework.security:spring-security-core | ≥ 5.0.0, < 5.0.16≥ 5.1.0, < 5.1.10≥ 5.2.0, < 5.2.4≥ 5.3.0, < 5.3.2< 4.2.16 | 5.0.165.1.105.2.45.3.24.2.16 |
| spring security | ≥ 5.2.0, < 5.2.4≥ 5.3.0, < 5.3.2 | 5.2.45.3.2 |
| spring security | ≥ 4.2.0, < 4.2.16≥ 5.0.0, < 5.0.16≥ 5.1.0, < 5.1.10 | 4.2.165.0.165.1.10 |
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free