Description
In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Spring Security | Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.426.3.1706515686-3.el8 | RHSA-2024:0778 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1706515741-1.el8 | RHSA-2024:0778 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 5.7.0, < 5.7.8 | 5.7.8 | GHSA-x873-6rgc-94jc |
| Maven | org.springframework.security:spring-security-core | >= 5.8.0, < 5.8.3 | 5.8.3 | GHSA-x873-6rgc-94jc |
| Maven | org.springframework.security:spring-security-core | >= 6.0.0, < 6.0.3 | 6.0.3 | GHSA-x873-6rgc-94jc |
Advisories 8
- RHSA-2024:0778 Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-0994 VMware Tanzu Spring Security: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jun 29, 2025
- WID-SEC-2023-1794 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 30, 2024
- WID-SEC-2023-2675 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-1812 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 20, 2023
- WID-SEC-2023-1813 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1782 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023