NetSight
IP …
medium6.5

CVE-2020-5408

Insufficient Entropy in Spring Security

Impact

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.springframework.security:spring-security-core>= 5.3.0, < 5.3.25.3.2

Affected products

VendorProductAffected versions
Pivotal SoftwareSpring Security
from 5.2.0 before 5.2.4
from 5.3.0 before 5.3.2
VmwareSpring Security
from 4.2.0 before 4.2.16
from 5.0.0 before 5.0.16
from 5.1.0 before 5.1.10

Weakness classification

CWE-329CWE-330

References