Description
The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pivotal | Spring Security | 3.2.0 to 3.2.1, 3.1.0 to 3.1.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 3.2.0, < 3.2.2.RELEASE | 3.2.2.RELEASE | GHSA-gv9v-c375-hvmg |
| Maven | org.springframework.security:spring-security-core | >= 3.1.0, < 3.1.5.RELEASE | 3.1.5.RELEASE | GHSA-gv9v-c375-hvmg |