CVE-2020-5408
14.05.2020, 18:15
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.Enginsight
| Vendor | Product | Version |
|---|---|---|
| pivotal_software | spring_security | 5.2.0 ≤ 𝑥 < 5.2.4 |
| pivotal_software | spring_security | 5.3.0 ≤ 𝑥 < 5.3.2 |
| vmware | spring_security | 4.2.0 ≤ 𝑥 < 4.2.16 |
| vmware | spring_security | 5.0.0 ≤ 𝑥 < 5.0.16 |
| vmware | spring_security | 5.1.0 ≤ 𝑥 < 5.1.10 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-329 - Generation of Predictable IV with CBC ModeThe product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
- CWE-330 - Use of Insufficiently Random ValuesThe software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
References