CVE-2020-5408GHSA-2PPP-9496-P23Q
Dictionary attack with Spring Security queryable text encryptor
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.2.16, 5.0.16, 5.1.10, 5.2.4, 5.3.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Timeline
- CVE published
- Record last updated
Affected versions
- Spring by VMware Spring Security
From 4.2 · fixed in 4.2.16; From 5.0 · fixed in 5.0.16; From 5.1 · fixed in 5.1.10; From 5.2 · fixed in 5.2.4; From 5.3 · fixed in 5.3.2
- org.springframework.security:spring-security-coreMaven
From 5.3.0 · fixed in 5.3.2
- org.springframework.security:spring-security-coreMaven
From 5.2.0 · fixed in 5.2.4
- org.springframework.security:spring-security-coreMaven
From 5.1.0 · fixed in 5.1.10
- org.springframework.security:spring-security-coreMaven
From 5.0.0 · fixed in 5.0.16
- org.springframework.security:spring-security-coreMaven
fixed in 4.2.16