PT-2017-5773 · Spring · Spring Security

Publicado 2017-05-25 · Atualizado 2022-05-13 · CVE-2014-0097

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Spring Security versions 3.1.0 through 3.1.5 Spring Security versions 3.2.0 through 3.2.1

Description: The issue concerns the ActiveDirectoryLdapAuthenticator in Spring Security, which fails to check the password length. This can lead to incorrect user authentication if the directory allows anonymous binds and an empty password is supplied.

Recommendations: For Spring Security versions 3.1.0 through 3.1.5, update to a version that includes the fix for this issue. For Spring Security versions 3.2.0 through 3.2.1, update to a version that includes the fix for this issue. As a temporary workaround, consider configuring the directory to disallow anonymous binds until a patch is available.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-0097

GHSA-GV9V-C375-HVMG

Produtos afetados

Spring Security

Referências · 8

• https://github.com/spring-projects/spring-security/commit/a7005bd74241ac8e2e7b38ae31bc4b0f641ef973 · Nota
• https://github.com/spring-projects/spring-security/commit/7dbb8e777ece8675f3333a1ef1cb4d6b9be80395 · Nota
• https://github.com/spring-projects/spring-security/commit/88559882e967085c47a7e1dcbc4dc32c2c796868 · Nota
• https://oracle.com/security-alerts/cpuapr2022.html · Nota
• https://pivotal.io/security/cve-2014-0097 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0097 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gv9v-c375-hvmg · Aviso do Fabricante
• https://jira.springsource.org/browse/SEC-2500 · Nota