CVE-2022-22976: Integer overflow in BCrypt class in Spring Security
Summary
CVE-2022-22976: Integer overflow in BCrypt class in Spring Security. Affects org.springframework.security:spring-security-core across 2 version ranges.
>= 5.2.0.RELEASE, < 5.5.7
>= 5.6.0, < 5.6.4
Fixed in 5.5.7 or 5.6.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.springframework.security:spring-security-core, which is a core module of the Spring Security framework. Spring Security provides comprehensive security services for Java applications, including authentication, authorization, and protection against common security vulnerabilities. It is widely used in enterprise applications to secure web and API endpoints, manage user access, and enforce security policies.
Vulnerability Detail
The vulnerability in Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions is an integer overflow in the BCrypt class. When using the BCryptPasswordEncoder with the maximum work factor (31), the encoder fails to perform any salt rounds due to an integer overflow error. This issue only affects configurations where BCrypt has been explicitly set with a work factor of 31. The default settings are not affected. The use of such a high work factor is computationally impractical due to current limitations in computer hardware. The vulnerability is assigned CVE-2022-22976 and has a CVSS score of 5.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.2.0.RELEASE, < 5.5.75.5.7 -
>= 5.6.0, < 5.6.45.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended fix is to update the Spring Security dependency as mentioned above.
Conclusion
In conclusion, the vulnerability in Spring Security's BCrypt class can lead to an integer overflow when using the maximum work factor. This issue affects specific configurations and can weaken password hashing security. It is recommended to update the Spring Security dependency to the fixed versions to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
Spring Security is a powerful and highly customizable security framework for Java applications. It provides authentication, authorization, and other security features to protect web and API endpoints.
The vulnerability affects Spring Security versions 5.5.x prior to 5.5.7 and 5.6.x prior to 5.6.4. Earlier unsupported versions may also be affected.
The impact of this vulnerability is limited to configurations where BCrypt has been explicitly set with a work factor of 31. The default settings and configurations with lower work factors are not affected. Exploiting this vulnerability could potentially weaken the security of password hashing in affected configurations.
Yes, the recommended fix is to update the Spring Security dependency to version 5.5.7 or later for projects using versions 5.5.x, and to version 5.6.4 or later for projects using versions 5.6.x.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
