CVE-2025-22228
Spring Security Does Not Enforce Password Length
Résumé
Spring Security Does Not Enforce Password Length
Description d'origine
La description telle que publiée par la source (souvent en anglais).
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.springframework.security:spring-security-crypto
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.16"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web security.netapp.com
- web spring.io