CVE-2020-5408: Insufficient Entropy in Spring Security
Summary
CVE-2020-5408: Insufficient Entropy in Spring Security. Affects org.springframework.security:spring-security-core across 5 version ranges.
< 4.2.16
>= 5.0.0, < 5.0.16
>= 5.1.0, < 5.1.10
>= 5.2.0, < 5.2.4
>= 5.3.0, < 5.3.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Security package is a widely used security framework for Java applications. It provides authentication and authorization mechanisms to protect sensitive data and resources. The package includes various modules, with the 'spring-security-core' module being one of the key components. This vulnerability affects versions 5.3.x, 5.2.x, 5.1.x, 5.0.x, and 4.2.x of the 'spring-security-core' package.
Vulnerability Detail
The vulnerability arises from the use of a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor in Spring Security. This flaw allows a malicious user with access to encrypted data to potentially derive the unencrypted values using a dictionary attack. The lack of sufficient entropy in the encryption process makes it easier for an attacker to guess the original values. The impact of this vulnerability can be significant, as it compromises the confidentiality of sensitive information.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.2.164.2.16 -
>= 5.0.0, < 5.0.165.0.16 -
>= 5.1.0, < 5.1.105.1.10 -
>= 5.2.0, < 5.2.45.2.4 -
>= 5.3.0, < 5.3.25.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if immediate package updates are not feasible, it is recommended to avoid using the queryable text encryptor in Spring Security. Instead, consider using alternative encryption mechanisms or libraries that are not affected by this vulnerability.
Conclusion
The CVE-2020-5408 vulnerability in Spring Security exposes a weakness in the encryption process, allowing potential decryption of encrypted data. Upgrading to the fixed versions of the 'spring-security-core' package is the recommended solution. If immediate updates are not possible, avoiding the use of the queryable text encryptor or employing alternative encryption mechanisms can help mitigate the risk. Stay vigilant and ensure the security of your application by addressing this vulnerability promptly.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
This vulnerability allows an attacker to potentially decrypt encrypted data by exploiting the insufficient entropy in the encryption process. It compromises the confidentiality of sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
There are no known instances of this vulnerability being actively exploited at the moment. However, it is crucial to apply the recommended fixes to ensure the security of your application.
Yes, you can mitigate this vulnerability by avoiding the use of the queryable text encryptor in Spring Security. Consider using alternative encryption mechanisms or libraries that are not affected by this vulnerability.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
