VMware Tanzu Spring Security: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 2

• High 7.4
  CVE-2025-22228

  CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

  BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

  Spring Spring Security thingsboard-tb-node thingsboard-tb-mqtt-transport Wolfi Maven
  Mar 20, 2025
• Medium 5.3
  CVE-2025-22223 Public exploit

  Spring Security Vulnerable to Authorization Bypass via Security Annotations

  Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass.  You are not affected if you are not using @EnableMethodSecurity, or you do not have method security …

  Spring Spring Security org.springframework.security:spring-security-core Maven
  Mar 24, 2025

Revision history

1. 2025-11-25 #10

   Neue Updates von IBM aufgenommen

2. 2025-11-18 #9

   Neue Updates aufgenommen

3. 2025-09-29 #8

   Neue Updates von HITACHI aufgenommen

4. 2025-07-15 #7

   Neue Updates aufgenommen

5. 2025-07-01 #6

   Neue Updates von Red Hat aufgenommen

6. 2025-06-17 #5

   Neue Updates von Atlassian aufgenommen

7. 2025-04-27 #4

   Neue Updates von NetApp aufgenommen

8. 2025-04-08 #3

   Neue Updates aufgenommen

9. 2025-04-02 #2

   Neue Updates von Red Hat aufgenommen

10. 2025-03-19 #1

    Initiale Fassung

References

• Spring Security 6.3.8 and 6.4.4 Release Notes vom 2025-03-19
  https://spring.io/blog/2025/03/19/spring-security-6-3-8-6-4-4-are-now-available
• CVE-2025-22223 Spring Security authorization bypass vom 2025-03-19
  https://spring.io/security/cve-2025-22223
• CVE-2025-22228 Spring Security BCryptPasswordEncoder does not enforce maximum password length vom 2025-03-19
  https://spring.io/security/cve-2025-22228
• Red Hat Security Advisory RHSA-2025:3543 vom 2025-04-02
  https://access.redhat.com/errata/RHSA-2025:3543
• Camunda Security Notices vom 2025-04-09
  https://docs.camunda.org/security/notices/#notice-133
• NetApp Security Advisory NTAP-20250425-0009 vom 2025-04-25
  https://security.netapp.com/advisory/ntap-20250425-0009/
• Atlassian Security Bulletin vom 2025-06-17
  https://confluence.atlassian.com/security/security-bulletin-june-17-2025-1574012717.html
• Red Hat Security Advisory RHSA-2025:10104 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10104
• Red Hat Security Advisory RHSA-2025:10120 vom 2025-07-02
  https://access.redhat.com/errata/RHSA-2025:10120
• Red Hat Security Advisory RHSA-2025:10097 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10097
• Red Hat Security Advisory RHSA-2025:10098 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10098
• Red Hat Security Advisory RHSA-2025:10092 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10092
• Red Hat Security Advisory RHSA-2025:10118 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10118
• Red Hat Security Advisory RHSA-2025:10119 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10119
• Atlassian Security Bulletin - July 15 2025
  https://confluence.atlassian.com/security/security-bulletin-july-15-2025-1590658642.html
• Hitachi Vulnerability Information HITACHI-SEC-2025-127 vom 2025-09-30
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-127/index.html
• Atlassian Security Bulletin - November 18 2025
  https://confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html
• IBM Security Bulletin 7252567 vom 2025-11-26
  https://www.ibm.com/support/pages/node/7252567