Insufficient Entropy in Spring Security
Moderate severity
GitHub Reviewed
Published
Jun 15, 2020
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 5.3.0, < 5.3.2
>= 5.2.0, < 5.2.4
>= 5.1.0, < 5.1.10
>= 5.0.0, < 5.0.16
< 4.2.16
Patched versions
5.3.2
5.2.4
5.1.10
5.0.16
4.2.16
Description
Published by the National Vulnerability Database
May 14, 2020
Reviewed
Jun 11, 2020
Published to the GitHub Advisory Database
Jun 15, 2020
Last updated
Feb 1, 2023
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
References