CVE-2022-22976
published 2022-05-19CVE-2022-22976: Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
2.28%
81.3th percentile
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| vmware | spring_security | — | — |
| vmware | spring_security | — | — |
| vmware | spring_security | >= 5.2.1 < 5.5.7 | 5.5.7 |
| vmware | spring_security | >= 5.6.0 < 5.6.4 | 5.6.4 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Integer overflow in BCrypt class in Spring Security
ghsa·2022-05-20
CVE-2022-22976 [MEDIUM] CWE-190 Integer overflow in BCrypt class in Spring Security
Integer overflow in BCrypt class in Spring Security
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
OSV
Integer overflow in BCrypt class in Spring Security
osv·2022-05-20
CVE-2022-22976 [MEDIUM] Integer overflow in BCrypt class in Spring Security
Integer overflow in BCrypt class in Spring Security
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
OSV
CVE-2022-22976: Spring Security versions 5
osv·2022-05-19·CVSS 5.3
CVE-2022-22976 [MEDIUM] CVE-2022-22976: Spring Security versions 5
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
Red Hat
springframework: BCrypt skips salt rounds for work factor of 31
vendor_redhat·2022-05-17·CVSS 5.3
CVE-2022-22976 [MEDIUM] CWE-190 springframework: BCrypt skips salt rounds for work factor of 31
springframework: BCrypt skips salt rounds for work factor of 31
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE.
A flaw was found in Spring Framework. The encoder does not perform any salt rounds when using the BCrypt class with the maximum work factor (31) due to an integer overflow error.
Package: springframework (A-MQ Clients 2) - Not affected
Package: springframework (Red Hat build of Quarkus) - Not affected
Package: springframework (Red Hat Data Grid 8) - Not affected
Package: springframework (
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://security.netapp.com/advisory/ntap-20220707-0003/https://tanzu.vmware.com/security/cve-2022-22976https://www.oracle.com/security-alerts/cpujul2022.htmlhttps://security.netapp.com/advisory/ntap-20220707-0003/https://tanzu.vmware.com/security/cve-2022-22976https://www.oracle.com/security-alerts/cpujul2022.html
2022-05-19
Published