CVE-2020-5408
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
| Software | From | Fixed in |
|---|---|---|
| pivotal_software / spring_security | 5.3.0 | 5.3.2 |
| pivotal_software / spring_security | 5.2.0 | 5.2.4 |
| vmware / spring_security | 4.2.0 | 4.2.16 |
| vmware / spring_security | 5.0.0 | 5.0.16 |
| vmware / spring_security | 5.1.0 | 5.1.10 |
org.springframework.security / spring-security-core
|
5.3.0 | 5.3.2 |
|
org.springframework.security / spring-security-core
|
5.2.0 | 5.2.4 |
|
org.springframework.security / spring-security-core
|
5.1.0 | 5.1.10 |
|
org.springframework.security / spring-security-core
|
5.0.0 | 5.0.16 |
|
org.springframework.security / spring-security-core
|
- | 4.2.16 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime