| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| org.springframework.security:spring-security-core | ≥ 5.2.0, < 5.2.11≥ 5.3.0, < 5.3.10≥ 5.4.0, < 5.4.7≥ 5.5.0, < 5.5.1 | 5.2.115.3.105.4.75.5.1 |
| org.springframework.security:spring-security-oauth2-client | ≥ 5.2.0, < 5.2.11≥ 5.3.0, < 5.3.10≥ 5.4.0, < 5.4.7≥ 5.5.0, < 5.5.1 | 5.2.115.3.105.4.75.5.1 |
| communications cloud native core policy | = 1.14.0 | |
| spring security | ≥ 5.2.0, < 5.2.11≥ 5.3.0, < 5.3.10≥ 5.4.0, < 5.4.7≥ 5.5.0, < 5.5.1 | 5.2.115.3.105.4.75.5.1 |
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí