GHSA-mg83-c7gq-rv5c

Source

https://github.com/advisories/GHSA-mg83-c7gq-rv5c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-mg83-c7gq-rv5c/GHSA-mg83-c7gq-rv5c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mg83-c7gq-rv5c

Aliases

CVE-2025-22228

Related

Published

2025-03-20T06:31:09Z

Modified

2025-04-26T01:25:16.786633Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Spring Security Does Not Enforce Password Length

Details

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Database specific

{
    "nvd_published_at": "2025-03-20T06:15:23Z",
    "cwe_ids": [
        "CWE-287",
        "CWE-521"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-20T18:19:20Z"
}

References

Affected packages

Maven / org.springframework.security:spring-security-crypto

Package

Name: org.springframework.security:spring-security-crypto; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.3.0

Fixed

6.3.8

Affected versions

6.*

6.3.0

6.3.1

6.3.2

6.3.3

6.3.4

6.3.5

6.3.6

6.3.7

Maven / org.springframework.security:spring-security-crypto

Package

Name: org.springframework.security:spring-security-crypto; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.4.0

Fixed

6.4.4

Affected versions

6.*

6.4.0

6.4.1

6.4.2

6.4.3

Maven / org.springframework.security:spring-security-crypto

Package

Name: org.springframework.security:spring-security-crypto; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.2.10

Affected versions

6.*

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

6.2.7

6.2.8

Database specific

{
    "last_known_affected_version_range": "<= 6.2.9"
}

Maven / org.springframework.security:spring-security-crypto

Package

Name: org.springframework.security:spring-security-crypto; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.1.0

Fixed

6.1.14

Affected versions

6.*

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

6.1.9

Database specific

{
    "last_known_affected_version_range": "<= 6.1.13"
}

Maven / org.springframework.security:spring-security-crypto

Package

Name: org.springframework.security:spring-security-crypto; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.0.16

Affected versions

6.*

6.0.0

6.0.1

6.0.2

6.0.3

6.0.4

6.0.5

6.0.6

6.0.7

6.0.8

Database specific

{
    "last_known_affected_version_range": "<= 6.0.15"
}

Maven / org.springframework.security:spring-security-crypto

Package

Name: org.springframework.security:spring-security-crypto; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.8.0

Fixed

5.8.18

Affected versions

5.*

5.8.0

5.8.1

5.8.2

5.8.3

5.8.4

5.8.5

5.8.6

5.8.7

5.8.8

5.8.9

5.8.10

5.8.11

5.8.12

5.8.13

5.8.14

5.8.15

5.8.16

Database specific

{
    "last_known_affected_version_range": "<= 5.8.17"
}

Maven / org.springframework.security:spring-security-crypto

Package

Name: org.springframework.security:spring-security-crypto; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-crypto

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.7.16

Affected versions

3.*

3.1.0.RELEASE

3.1.1.RELEASE

3.1.2.RELEASE

3.1.3.RELEASE

3.1.4.RELEASE

3.1.5.RELEASE

3.1.6.RELEASE

3.1.7.RELEASE

3.2.0.RELEASE

3.2.1.RELEASE

3.2.2.RELEASE

3.2.3.RELEASE

3.2.4.RELEASE

3.2.5.RELEASE

3.2.6.RELEASE

3.2.7.RELEASE

3.2.8.RELEASE

3.2.9.RELEASE

3.2.10.RELEASE

4.*

4.0.0.RELEASE

4.0.1.RELEASE

4.0.2.RELEASE

4.0.3.RELEASE

4.0.4.RELEASE

4.1.0.RELEASE

4.1.1.RELEASE

4.1.2.RELEASE

4.1.3.RELEASE

4.1.4.RELEASE

4.1.5.RELEASE

4.2.0.RELEASE

4.2.1.RELEASE

4.2.2.RELEASE

4.2.3.RELEASE

4.2.4.RELEASE

4.2.5.RELEASE

4.2.6.RELEASE

4.2.7.RELEASE

4.2.8.RELEASE

4.2.9.RELEASE

4.2.10.RELEASE

4.2.11.RELEASE

4.2.12.RELEASE

4.2.13.RELEASE

4.2.14.RELEASE

4.2.15.RELEASE

4.2.16.RELEASE

4.2.17.RELEASE

4.2.18.RELEASE

4.2.19.RELEASE

4.2.20.RELEASE

5.*

5.0.0.RELEASE

5.0.1.RELEASE

5.0.2.RELEASE

5.0.3.RELEASE

5.0.4.RELEASE

5.0.5.RELEASE

5.0.6.RELEASE

5.0.7.RELEASE

5.0.8.RELEASE

5.0.9.RELEASE

5.0.10.RELEASE

5.0.11.RELEASE

5.0.12.RELEASE

5.0.13.RELEASE

5.0.14.RELEASE

5.0.15.RELEASE

5.0.16.RELEASE

5.0.17.RELEASE

5.0.18.RELEASE

5.0.19.RELEASE

5.1.0.RELEASE

5.1.1.RELEASE

5.1.2.RELEASE

5.1.3.RELEASE

5.1.4.RELEASE

5.1.5.RELEASE

5.1.6.RELEASE

5.1.7.RELEASE

5.1.8.RELEASE

5.1.9.RELEASE

5.1.10.RELEASE

5.1.11.RELEASE

5.1.12.RELEASE

5.1.13.RELEASE

5.2.0.RELEASE

5.2.1.RELEASE

5.2.2.RELEASE

5.2.3.RELEASE

5.2.4.RELEASE

5.2.5.RELEASE

5.2.6.RELEASE

5.2.7.RELEASE

5.2.8.RELEASE

5.2.9.RELEASE

5.2.10.RELEASE

5.2.11.RELEASE

5.2.12.RELEASE

5.2.13.RELEASE

5.2.14.RELEASE

5.2.15.RELEASE

5.3.0.RELEASE

5.3.1.RELEASE

5.3.2.RELEASE

5.3.3.RELEASE

5.3.4.RELEASE

5.3.5.RELEASE

5.3.6.RELEASE

5.3.7.RELEASE

5.3.8.RELEASE

5.3.9.RELEASE

5.3.10.RELEASE

5.3.11.RELEASE

5.3.12.RELEASE

5.3.13.RELEASE

5.4.0

5.4.1

5.4.2

5.4.3

5.4.4

5.4.5

5.4.6

5.4.7

5.4.8

5.4.9

5.4.10

5.4.11

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.5.8

5.6.0

5.6.1

5.6.2

5.6.3

5.6.4

5.6.5

5.6.6

5.6.7

5.6.8

5.6.9

5.6.10

5.6.11

5.6.12

5.7.0

5.7.1

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

5.7.9

5.7.10

5.7.11

5.7.12

5.7.13

5.7.14

Database specific

{
    "last_known_affected_version_range": "<= 5.7.15"
}