Description
Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring by VMware | Spring Security | 5.2 – < 5.2.4, 5.3 – < 5.3.2 | 5.2.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 5.2.0, < 5.2.4 | 5.2.4 | GHSA-48rw-j489-928m |
| Maven | org.springframework.security:spring-security-core | >= 5.3.0, < 5.3.2 | 5.3.2 | GHSA-48rw-j489-928m |
References
- [servicemix-issues] 20200514 [jira] [Created] (SM-4384) Create OSGi bundles for spring-security 5.3.2.RELEASE + 5.1.10.RELEASE mailing-list
- [geode-dev] 20200521 Re: Proposal to backport GEODE-8167 mailing-list
- [geode-dev] 20200521 Proposal to backport GEODE-8167 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://tanzu.vmware.com/security/cve-2020-5407
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html