All Vulnerability Reports

CVE-2020-5408: Dictionary attack with Spring Security queryable text encryptor

Medium

Spring by VMware

Spring Security versions 5.3.x prior to 5.3.2,  5.2.x prior to 5.2.4,  5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.

Severity is medium unless otherwise noted.

• Spring Security
  • 5.3.x prior to 5.3.2
  • 5.2.x prior to 5.2.4
  • 5.1.x prior to 5.1.10
  • 5.0.x prior to 5.0.16
  • 4.2.x prior to 4.2.16

All users should discontinue the use of Encryptors#queryableText(CharSequence, CharSequence) and rely on their data store for querying encrypted data. Users should perform the following upgrades, as this method has been deprecated in newer versions of Spring Security. Older versions should upgrade to a supported branch. Releases that have fixed this issue include:

• Spring Security
  • 5.3.2
  • 5.2.4
  • 5.1.10
  • 5.0.16
  • 4.2.16

This issue was identified and responsibly reported by Neil Madden, ForgeRock.

• https://cwe.mitre.org/data/definitions/329.html

2020-05-07: Initial vulnerability report published.