Spring Security Advisories

CVE-2020-5408: Dictionary attack with Spring Security queryable text encryptor

MEDIUM | MAY 07, 2020 | CVE-2020-5408

Description

Spring Security versions 5.3.x prior to 5.3.2,  5.2.x prior to 5.2.4,  5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.

Affected Spring Products and Versions

  • Spring Security
    • 5.3.x prior to 5.3.2
    • 5.2.x prior to 5.2.4
    • 5.1.x prior to 5.1.10
    • 5.0.x prior to 5.0.16
    • 4.2.x prior to 4.2.16

Mitigation

All users should discontinue the use of Encryptors#queryableText(CharSequence, CharSequence) and rely on their data store for querying encrypted data. Users should perform the following upgrades, as this method has been deprecated in newer versions of Spring Security. Older versions should upgrade to a supported branch. Releases that have fixed this issue include:

  • Spring Security
    • 5.3.2
    • 5.2.4
    • 5.1.10
    • 5.0.16
    • 4.2.16

Credit

This issue was identified and responsibly reported by Neil Madden, ForgeRock.

History

  • 2020-05-07: Initial vulnerability report published.

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring Runtime offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all