Spring Security Vulnerability CVE-2022-22976 

Issue date: 21-09-2022
Affects versions: 15.1, 14.7, 13.4

Security Issue ID

SECURITY-340

 

Affected Product Version(s)

15.1.0, 14.7.8, 13.4.18, and all previous versions

Severity 

medium

Description

CVE-2022-22976

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.

This feature of Spring Security is not used by brXM, so the product is not directly vulnerable. However, it may have been used by customer project code.

Instructions

Verify that project code does not use the affected BCrypt class.