CVE-2020-5408: Dictionary attack with Spring Security queryable text encryptor
Severity
Medium
Vendor
Spring by VMware
Description
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Affected VMware Products and Versions
Severity is medium unless otherwise noted.
-
Spring Security
- 5.3.x prior to 5.3.2
- 5.2.x prior to 5.2.4
- 5.1.x prior to 5.1.10
- 5.0.x prior to 5.0.16
- 4.2.x prior to 4.2.16
Mitigation
All users should discontinue the use of Encryptors#queryableText(CharSequence, CharSequence) and rely on their data store for querying encrypted data. Users should perform the following upgrades, as this method has been deprecated in newer versions of Spring Security. Older versions should upgrade to a supported branch. Releases that have fixed this issue include:
-
Spring Security
- 5.3.2
- 5.2.4
- 5.1.10
- 5.0.16
- 4.2.16
Credit
This issue was identified and responsibly reported by Neil Madden, ForgeRock.
References
History
2020-05-07: Initial vulnerability report published.