PT-2017-5773 · Spring · Spring Security

Published 2017-05-25 · Updated 2022-05-13 · CVE-2014-0097

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Spring Security versions 3.1.0 through 3.1.5 Spring Security versions 3.2.0 through 3.2.1

Description: The issue concerns the ActiveDirectoryLdapAuthenticator in Spring Security, which fails to check the password length. This can lead to incorrect user authentication if the directory allows anonymous binds and an empty password is supplied.

Recommendations: For Spring Security versions 3.1.0 through 3.1.5, update to a version that includes the fix for this issue. For Spring Security versions 3.2.0 through 3.2.1, update to a version that includes the fix for this issue. As a temporary workaround, consider configuring the directory to disallow anonymous binds until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-0097

GHSA-GV9V-C375-HVMG

Affected Products

Spring Security

References · 8

• https://pivotal.io/security/cve-2014-0097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0097 · Security Note
• https://osv.dev/vulnerability/GHSA-gv9v-c375-hvmg · Vendor Advisory
• https://github.com/spring-projects/spring-security/commit/a7005bd74241ac8e2e7b38ae31bc4b0f641ef973 · Note
• https://github.com/spring-projects/spring-security/commit/7dbb8e777ece8675f3333a1ef1cb4d6b9be80395 · Note
• https://github.com/spring-projects/spring-security/commit/88559882e967085c47a7e1dcbc4dc32c2c796868 · Note
• https://oracle.com/security-alerts/cpuapr2022.html · Note
• https://jira.springsource.org/browse/SEC-2500 · Note