CVE-2025-22228
Spring Security Does Not Enforce Password Length
概要
Spring Security Does Not Enforce Password Length
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Maven
org.springframework.security:spring-security-crypto
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.16"}]}]
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web security.netapp.com
- web spring.io